Securing the Missing Link: Encrypted Recursive-to-Authoritative DNS in the Wild#

Authors: Yevheniya Nosyk, Simon Fernandez, Andrzej Duda, Maciej Korczyński (KOR Labs / Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG)

• Why: The recursive-to-authoritative hop is the last unencrypted DNS link, and it is the one state censors have demonstratively used for traffic analysis and response injection. RFC 9539 (opportunistic ADoT/ADoQ) is the mechanism intended to close it — this paper tells you how much of the Internet actually speaks it.
• What: A measurement of RFC 9539 deployment covering both recursive resolvers and authoritative nameservers. Bottom line: fewer than 1% of registered domains (3.1M) support authoritative DoT or DoQ, with one provider accounting for the vast majority of those deployments. (from abstract only)
• How: Probing resolvers and authoritative nameservers for opportunistic DNS-over-TLS / DNS-over-QUIC support per the RFC 9539 mechanism.
• Where applicable: DNS operators weighing authoritative-side encryption; also useful context for standards bodies tracking adoption. The near-absence of deployment means privacy-sensitive resolvers currently get almost no recursive-to-authoritative confidentiality in practice.