namefill: Synthesizing DNS Naming Conventions#

Authors: Joel Sommers (Colgate University), Calvin Kranig, Wei-Shiang Wung, Paul Barford (University of Wisconsin-Madison), Mark Crovella (Boston University), Eric Pauley (Virginia Tech & Terrace Networks)

• Why: DNS naming conventions leak infrastructure topology and operational structure — this work makes them machine-usable both for asset discovery and for auditing your own records. For anyone who cares about IPAM hygiene or infrastructure enumeration, this is a genuinely new tool capability.
• What: namefill uses programming by example to synthesize executable functions that summarize DNS naming conventions. Unlike regexes, the synthesized functions can generate predicted FQDNs, enabling active probing for undiscovered names and systematic auditing of existing records. Applied to 1.2 billion PTR records: 313K distinct conventions across 254K domains, covering 67.7% of IP/FQDN pairs (complementary to geotoken-focused tools). Found 991 misconfigurations (43 verified with operators) and, as a discovery tool, surfaced 194M previously unrecorded forward DNS names from 2.76M training names — a 70× expansion. (from abstract only)
• How: Programming-by-example synthesis over PTR records; validation against CAIDA's ITDK dataset; systematic anomaly detection using the synthesized functions; active enumeration queries for discovery.
• Where applicable: General technique — researchers and operators auditing reverse DNS or discovering infrastructure. Note the dual-use nature: the same discovery capability that finds your misconfigurations finds your unrecorded hosts.