D. J. Bernstein
Internet surveys

DNS software

Question: What DNS software is used to publish second-level *.com domains, such as aol.com and yahoo.com?

Answers:
100%22009174.0000000000total domains
133802.1241674949DNS server had no IP address
6%1294333.8423302637DNS server did not respond (timeout, etc.)
94%20581038.0335022414total domains with responsive servers
45%9985752.5056816973apparently BIND 8
23%4996120.8615144691apparently BIND 9
8%1861932.6730244388apparently tinydns
3%553993.8007402525apparently eNom DNS server
2%385119.4544371489apparently BIND 4
1%307805.2790583625unidentified pattern 1
1%250983.7511903548unidentified pattern 2
1%230268.4706348934apparently Simple DNS Plus
1%110886.4443223440unidentified pattern 3
82750.4991674994unidentified pattern 4
79269.6170995460unidentified pattern 5
74936.7035713704unidentified pattern 6
68359.0642856742unidentified pattern 7
35365.9777777768apparently UltraDNS
33104.8766233759apparently POWERDNS
19594.7619047587apparently Incognito DNS Commander
184.6666666665apparently MaraDNS
45.9166666666apparently NSD
1504562.7091349456thousands of other unidentified patterns
Explanation for the fractions: If a domain is published by n different DNS servers, it is counted as 1/n domains for each server. More precisely: A domain with n NS records gives weight 1/n to each record; an weight-x NS record with i IP addresses gives weight x/i to each address.

A small number of servers account for a large fraction of the survey results. For example, tinydns is used

and so on. The top 20 DNS servers publish 2 million .com domains; the top 200 DNS servers publish 7 million .com domains.

Survey structure

I started with the .com zone downloaded directly from VeriSign. This zone lists (among other things) all second-level *.com domains and the NS records for those domains.

This version of the survey worked with the 2002.12.17 version of the .com zone. There are 22009173 second-level *.com domains. I also included the first-level .com itself, for a total of 22009174 domains. These domains have 599366 different NS names.

I did DNS lookups to find the IP addresses for all the NS names. These lookups found 487828 different IP addresses; there were also 35629 NS names for which IP addresses were (temporarily or permanently) unavailable in DNS.

I then determined which software was running on these IP addresses, by sending various DNS packets to each IP address and observing the responses. The DNS packets and responses are listed below. All packets were sent from 131.193.178.100 (network-surveys.cr.yp.to).

DNS packets

Here are the DNS packets sent by the surveying program:
PacketNotes
1"\0\0\10\0\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\1"OPCODE 1. This is an obsolete ``inverse query'' request for test.network-surveys.cr.yp.to.
2"\0\0\0\0\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\3"Class-3 (CH) query for test.network-surveys.cr.yp.to.
3"\0\0\0\0\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\77"Class-63 query for test.network-surveys.cr.yp.to. Logged by BIND as ``no root nameservers for class CLASS63'' or ``no matching view in class CLASS63.''
4"\0\0\0\0\0\2\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\1\0\0\20\0\1"Packet with two queries, one for test.network-surveys.cr.yp.to and one for the root.
5"\0\0\40\0\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\1"OPCODE 4. This is a ``NOTIFY'' request for test.network-surveys.cr.yp.to. Logged by BIND as ``notify question section contains no SOA'' or ``not authoritative for notify zone'' or ``name not one of our zones.''
6"\0\0\50\0\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\1"OPCODE 5. This is an empty ``UPDATE'' request (which has no effect) for test.network-surveys.cr.yp.to (which is unused). Logged by BIND as ``update zone section contains non-SOA.''
7"\0\0\0\0\0\0\0\0\0\0\0\0"Packet with no queries. Logged by advICE as ``DNS null.''
8"\0\0\0\0\0\1\0\0\0\0\0\0\6"Query truncated inside the name.
9"\0\0\0\0\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0"Query truncated after the name.
10"\0\0\2\0\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\1"Query with the TC bit set.
11"\0\0\0\0\0\1\0\0\0\0\0\0\7Authors\4BIND\0\0\20\0\3"Class-3 (CH) query for Authors.BIND, which has special meaning to BIND 9.
12"\0\0\4\0\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\1"Query with the AA bit set.
13"\0\0\0\17\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\1"Query with RCODE 15.
14"\0\0\0\20\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\1"Query with the Z0 bit set.
15"\0\0\0\40\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\1"Query with the Z1 bit set.
16"\0\0\0\100\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\1"Query with the Z2 bit set.
17"\0\0\20\0\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\1"OPCODE 2. This is an obsolete ``STATUS'' request for test.network-surveys.cr.yp.to.
18"\0\0\30\0\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\1"OPCODE 3. No semantics have been assigned to this opcode.
19"\0\0\60\0\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\1"OPCODE 6. No semantics have been assigned to this opcode.
20"\0\0\0\0\0\1\0\0\0\0\0\0\4test\17network-surveys\2cr\2yp\2to\0\0\20\0\1"A real query for test.network-surveys.cr.yp.to.
21"\0\0\0\0\0\1\0\0\0\0\0\0\25erre-con-erre-cigarro\7maradns\3org\0\0\20\0\1"A real query for something in maradns.org, which has special meaning to MaraDNS.
22"\0\0\0\0\0\1\0\0\0\0\0\0\7version\6server\0\0\20\0\3"Class-3 (CH) query for version.server, which has special meaning to NSD.
23"\0\0\0\0\0\1\0\0\0\0\0\0\7version\4bind\0\0\20\0\3"Class-3 (CH) query for version.bind, which has special meaning to several servers.

Responses

Codes used in describing responses:
ttimeout: no response after 5 tries
0RCODE 0: normal answer
1RCODE 1: format error
2RCODE 2: server failure
3RCODE 3: no such domain
4RCODE 4: not implemented
5RCODE 5: refused
TCTC bit is set
RDRD bit is set
AAAA bit is set
Z0Z0 bit is set
Z1Z1 bit is set
Z2Z2 bit is set
qno queries listed in the response
Q2two queries listed in the response
Xresponse does not match query (e.g., different class)
Dresponse includes answer records
Miscellaneous server responses:
Software1234567891011121314151617181920212223
eNom DNS server00X0X0Q2001qtt00X00000000000X0X
Incognito DNS Commander -3.24X0, 2, 510, 0AA, 0AAQ2, 0Q2, 3AAQ2, 3Q2X0, 30X, 1, 50q1, 2X1000150004X4X4X0000AAD
Incognito DNS Commander 3.5-4X0, 2, 510, 0AA, 0AAQ2, 0Q2, 3AAQ2, 3Q2X31, 511X100AA, 20150004X4X4X00, 0AA2, 50AAD
MaraDNS before 1.04q5q5q4q4q4q4qtt5q5q5q5q5q5q5q4q4q4q5q0D5q5q
MaraDNS 1.0-4q5q5qt4q4q4qtt5q5q5q5q5q5q5q4q4q4q5q0D, 5q5q5q
NSD4q551q4q4q1q1q1q1q5222224q4q4q220D5
Simple DNS Plus4440X41t1104000004440040D, 4
Simple DNS Plus4440AAX41t110AA40AA0AA0AA0AA0AA4440AA0AA40D, 4
Simple DNS Plus4440Xt4ttt04000004440040D, 4
UltraDNS4001q391q1q000000004440000AAD
tinydns responses:
Software1234567891011121314151617181920212223
tinydns -1.044AAttt4AA4AAttt4AAt4AAtttt4AA4AA4AAtttt
tinydns -1.04 with root NS4AAttt4AA4AAttt4AAt4AA00004AA4AA4AA00tt
tinydns -1.04 with local root4AAttt4AA4AAttt4AAt4AA0AA0AA0AA0AA4AA4AA4AA0AA0AAtt
tinydns -1.04 with wildcard root4AAttt4AA4AAttt4AAt4AA3AA3AA3AA3AA4AA4AA4AA3AA3AAtt
tinydns 1.054AA1RD1RDt4AA4AAttt4AA1RD4AAtttt4AA4AA4AAtt1RD1RD
tinydns 1.05 with root NS4AA1RD1RDt4AA4AAttt4AA1RD4AA00004AA4AA4AA00, 0TC1RD1RD
tinydns 1.05 with local root4AA1RD1RDt4AA4AAttt4AA1RD4AA0AA0AA0AA0AA4AA4AA4AA0AA0AA1RD1RD
tinydns 1.05 with big root4AA1RD1RDt4AA4AAttt4AA1RD4AA0TC0TC0TC0TC4AA4AA4AA0TC0TC1RD1RD
tinydns 1.05 with wildcard root4AA1RD1RDt4AA4AAttt4AA1RD4AA3AA3AA3AA3AA4AA4AA4AA3AA3AA1RD1RD
tinydns 1.05 variant4AA1RD1RDt4AA4AAttt4AA1RD4AA55554AA4AA4AA551RD1RD
POWERDNS responses:
Software1234567891011121314151617181920212223
POWERDNS4AA0AA0AAX2X, 0AAX0AAX, 2AA0AAX, 4AA0AA, tt0AA, 2, t0AAX, 20AA0AAX, 20AAX0AAX0AAX0AAX0AAX0AAX0AAX0AAX0AA, 20AA0AAD
POWERDNS4AA0AA0AAX2X, 0AAX0AAX, 2AA0AAX, 4AA0AA, tt0AA, 2, t0AAX, 20AA0AAX, 20AAX0AAX0AAX2222220AA0AAD
POWERDNS4AA0AA0AAX2X, 0AAX0AAX, 2AA0AAX, 4AA0AA, tt0AA, 2, t0AAX, 20AA0AAX, 22222220AAX, 20AAX, 220AA0AAD
POWERDNS4AA0AA0AA2X4AA4AA0AAt0AA20AA222224AA4AA4AA220AA0AAD
POWERDNS4AA0AA0AAX3AAX0AAX0AAX0AAt3AA3AA0AA3AA3AA3AA3AA3AA3AA3AA3AA3AA3AA0AA0AAD
BIND 4 responses:
Software1234567891011121314151617181920212223
BIND -4.9.71q0, 20, 21q4q, 5, 24q1q1X10TC, 2TC0, 20, 2, 0AA, 2AA0, 2, 0AA0AAZ00AAZ10AAZ24q4q4q, 5q0AA0AA0, 20, 2, 0AAD
BIND -4.9.71q0, 20, 21q4q, 5, 24q1q1X10TC, 2TC0, 20, 2, 0AA, 2AA0, 2, 0AA0Z0, 2Z00Z1, 2Z10Z2, 2Z24q4q4q, 5q0, 20, 20, 20, 2, 0AAD
BIND 4.9.8-1q0, 20, 21q4q, 5, 24q1q1q1q0TC0, 20, 20, 20Z0, 2Z00Z1, 2Z10Z2, 2Z24q4q4q0, 20, 20, 20, 2, 0AAD
BIND 8 responses:
Software1234567891011121314151617181920212223
BIND 8.11q0, 2, 50, 2, 51q2, 4, 51q1q1X10TC, 0TCZ1, 3TC, 5TC0, 0AA, 2, 3, 3AA, 50, 2, 3, 3AA, 50, 2, 3, 3AA, 50Z0, 2Z0, 3AAZ0, 3Z0, 5Z00Z1, 2Z1, 3AAZ1, 3Z1, 5Z10Z2, 2Z2, 3AAZ2, 3Z2, 5Z24q4q4q0, 2, 3, 3AA, 50, 0AA, 2, 3, 3AA, 50, 2, 3, 50AAD, 0, 3, 5
BIND 8.11q0, 2, 50, 2, 51q2, 4, 51q1q1X10TC, 0TCZ1, 3TC, 5TC0, 0AA, 2, 3, 3AA, 50, 2, 3, 3AA, 50, 2, 3, 3AA, 50Z0, 2Z0, 3AAZ0, 3Z0, 5Z000Z2, 2Z2, 3AAZ2, 3Z2, 5Z24q4q4q0, 2, 3, 3AA, 50, 0AA, 2, 3, 3AA, 50, 2, 3, 50AAD, 0, 3, 5
BIND 8.11q0, 2, 50, 2, 51q2, 4, 51q1q1X1q0TC, 0TCZ1, 3TC, 5TC0, 0AA, 2, 3, 3AA, 50, 2, 3, 3AA, 50, 2, 3, 3AA, 50Z0, 2Z0, 3AAZ0, 3Z0, 5Z00Z1, 2Z1, 3AAZ1, 3Z1, 5Z10Z2, 2Z2, 3AAZ2, 3Z2, 5Z24q4q4q0, 2, 3, 3AA, 50, 0AA, 2, 3, 3AA, 50, 2, 3, 50AAD, 0, 3, 5
BIND 8.2-1q0, 2, 50, 2, 51q2, 4, 51q1q1q1q0TC, 0TCZ1, 3TC, 5TC0, 0AA, 2, 3, 3AA, 50, 2, 3, 3AA, 50, 2, 3, 3AA, 50Z0, 2Z0, 3AAZ0, 3Z0, 5Z00Z1, 2Z1, 3AAZ1, 3Z1, 5Z10Z2, 2Z2, 3AAZ2, 3Z2, 5Z24q4q4q0, 2, 3, 3AA, 50, 0AA, 2, 3, 3AA, 50, 2, 3, 50AAD, 0, 3, 5
BIND 8.2-1q0, 2, 50, 2, 51q2, 4, 51q1q1q1q0TC, 0TCZ1, 3TC, 5TC0, 0AA, 2, 3, 3AA, 50, 0AA, 2, 3, 3AA, 50, 0AA, 2, 3, 3AA, 50Z0, 0AAZ0, 2Z0, 3AAZ0, 3Z0, 5Z00, 0AA, 2, 3, 3AA0Z2, 0AAZ2, 2Z2, 3AAZ2, 3Z2, 5Z24q4q4q0, 0AA, 2, 3, 3AA, 50, 0AA, 2, 3, 3AA, 50, 2, 3, 50AAD, 0, 3, 5
BIND 9 responses:
Software1234567891011121314151617181920212223
BIND 9.04q551q51q5q1q1q0Z150Z115Z10Z10Z10Z14q4q4q0Z10Z150AAZ1D, 2, 5
BIND 9.14q551q51q1q1q1q00AA0150004q4q4q0050AAD, 2, 5
BIND 9.14q551q51q1q1q1q20AA222224q4q4q2250AAD, 2, 5
BIND 9.14q551q51q1q1q1q50AA555554q4q4q5550AAD, 2, 5
BIND 9.24q551q21q1q1q1q0AA0AA, 50AA0AA0AA0AA0AA4q4q4q0AA0AA50AAD, 2, 5
BIND 9.24q551q21q1q1q1q3AA0AA3AA3AA3AA3AA3AA4q4q4q3AA3AA50AAD, 2, 5
BIND 9.24q551q21q1q1q1q0, 2, 3, 50AA, 2, 50, 2, 3, 50, 5, 150, 2, 3, 50, 2, 3, 50, 2, 3, 54q4q4q0, 2, 3, 50, 2, 3AA, 550AAD, 2, 5
BIND 9.34q251q2, 51q1q1q1q0, 50AA, 2, 3AA, 5000004q4q4q002, 50AAD, 2, 3AA, 5
BIND 9.34q251q2, 51q1q1q1q0, 50AA, 2, 3AA, 50150004q4q4q0020AAD, 2, 3AA, 5
BIND 9.34q251q2, 51q1q1q1q0, 50AA, 2, 3AA, 5555554q4q4q5520AAD, 2, 3AA, 5
Unidentified patterns:
Pattern1234567891011121314151617181920212223
11tttttt1t0t0150Z000ttt00t4
21tttttt100t0150Z000ttt00tt
34551Q2441q153TCAA53AA3AA3AAZ03AAZ13AAZ24443AA3AA55
4t445Q2Xttt44t45AA55Z05Z15Z2ttt5544
51441Q2t41q140TC40150Z0004440044
61tttttt122t222Z022ttt22tt
71441Q2t41q100TC40150Z0004440044