.png){kind=icon}
.png){kind=icon}
Return
A Survey and Evaluation Framework for Secure DNS Resolution
.png){kind=icon}
PRE
AI
A
A
P
DOI：10.1109/COMST.2026.3678148.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Since security was not among the original design goals of the Domain Name System (herein called Vanilla DNS), many secure DNS schemes have been proposed to enhance the security and privacy of the DNS resolution process. Some proposed schemes aim to replace the existing DNS infrastructure entirely, but none have succeeded in doing so. In parallel, numerous schemes focus on improving DNS security without modifying its fundamental two-stage structure. These efforts highlight the feasibility of addressing DNS security as two distinct but compatible stages. We survey DNS resolution process attacks and threats and develop a comprehensive threat model and attack taxonomy for their systematic categorization. This analysis results in the formulation of 14 desirable security, privacy, and availability properties to mitigate the identified threats. Using these properties, we develop an objective evaluation framework and apply it to comparatively analyze 14 secure DNS schemes surveyed in this work that aim to augment the properties of the DNS resolution process. Our evaluation reveals that no single scheme provides ideal protection across the entire resolution path. Instead, the schemes tend to address a subset of properties specific to individual stages. Since these schemes target different stages of DNS resolution and are complementary, combining compatible schemes offers a practical and effective approach to achieving comprehensive security in the DNS resolution process.
Keywords:
DNS security
DNS privacy
DNS resolution
threat model
attack taxonomy
evaluation framework
DNSSEC alternatives
Journal
I
IF:
0
Papers:
67
Citations:
0
Organization
Cited Papers