谷歌已修复 Chromium 浏览器引擎中的缺陷，该缺陷曾导致其大量查询 DNS 根服务器，但持有着似乎对韧性有着奇特理解的互联网服务提供商（ISP）如今成了互联网资源可能出于善意却过度消耗的新来源。ICANN 首席技术官办公室于周一在印度尼西亚巴厘岛举行的该治理机构年度会议上表达了这一观点，在一个分享其标识符技术健康指标（ITHI）研究项目最新数据的会议环节中，该项目监测域名系统的安全性、稳定性和韧性。
Google has fixed the flaws in the Chromium browser engine that saw it poll DNS root servers, but ISPs who seem to have odd views about resilience now emerged as a new source of probably-well-meaning overconsumption of internet resources. ICANN’s office of the Chief Technology Officer delivered that view on Monday during the governance org’s annual conference in Bali, Indonesia, in a session that shared recent data from its Identifier Technology Health Indicators (ITHI) research program which monitors the security, stability and resilience of the domain name system.
ICANN 首席技术专家莫德·杜兰（Maud Durand）首先讨论了“Chromiods”这一 Chrome 浏览器的古怪缺陷：出于善意、为避免一种形式的 DNS 劫持所做的努力，导致该浏览器在 2020 年产生了约一半的 DNS 根服务器流量。考虑到 Chrome 的巨大普及率，这种流量是不受欢迎的。ICANN 以及其他互联网互联和治理利益相关方要求谷歌解决该问题。
ICANN principal technologist Maud Durand opened with a discussion of “Chromiods” the odd flaw in Chrome that meant well-meaning efforts to avoid a form of DNS hijacking caused the browser to generate about half of all DNS root server traffic during the year 2020. Given Chrome’s enormous prevalence, that traffic was unwelcome. ICANN, plus other internetworking and governance stakeholders, told Google to sort it out.
杜兰表示，“巧克力工厂”（谷歌的代称）逐步做到了这一点。ICANN 一直在持续测量 Chrome 造成的影响，杜兰分享了下图，图表显示该浏览器占 DNS 根服务器流量的份额从 45% 降至如今的 1%。正如杜兰所描述的，“已降至噪音水平。”
Durand said the Chocolate Factory gradually did. ICANN has kept measuring the impact Chrome makes and Durand shared the graph below which shows the browser’s share of DNS root server traffic falling from 45 percent to one percent today. Or as Durand described it, “in the noise.”
ICANN 现在检测到一个新的异常 DNS 流量来源：为每一位客户的每一个请求都使用多个 DNS 服务器的 ISP。“每一个 DNS 查询都会被发送三次：发给谷歌、Cloudflare 和另一个 DNS 解析器，”杜兰表示，将这种做法称为“双重保险”式做法，因为通常单一解析器就足以维持服务运行。指定主、备 DNS 解析器以防其中一个失效是良好做法。
ICANN has now detected a new source of odd DNS traffic: ISPs that use multiple DNS servers for every one of their customers’ requests. “Every single DNS query is sent three times: to Google, to Cloudflare, and to another DNS resolver,” Durand said, labelling this practice a “belt and suspenders” approach because a single resolver usually suffices to keep services up. It’s good practice to specify primary and secondary DNS resolvers, in case one doesn’t work.
但 DNS 解析器本身已非常有韧性，发起多重请求属于不寻常行为。ICANN 发现的这些 ISP 通过 IPv4 和 IPv6 发送 DNS 请求，对于未缓存的请求，在约一半的查询中会在 100 毫秒内重复发送。
But DNS resolvers are already very resilient, and making multiple requests is unusual. The ISPs ICANN has spotted send DNS requests over IPv4 and IPv6, and for non-cached requests repeat them within 100 milliseconds for about half of queries.
另有30%的请求在三十秒内重复。“很难说这是一个bug还是某种特定行为，”杜兰德说，随后提出了他个人的看法：使用这种奇怪的弹性技术的互联网服务提供商可能无法招聘到熟练的互联网工程师，因此创造了一种蛮力式的弹性例程。该组织正在研究其原因。ICANN认为，采用这种做法的互联网服务提供商并非主要参与者，但该组织担心，如果这种做法变得普遍，或被大型实体采用，可能会产生不良影响。
A further 30 percent repeat within thirty seconds. “It is hard to know if it is a bug or a specific behaviour,” Durand said, before advancing a personal theory that the ISPs who use this odd resilience technique can’t hire skilled internetworking engineers and therefore created a kind of brute-force resilience routine. The organization is researching the cause. ICANN feels the ISPs using this practice aren’t major players, but the org worries that if the practice becomes widespread, or is adopted by a large entity, it could have a nasty impact.
无谓繁忙的DNS服务器也很重要，因为ICANN认为DNS服务提供商的数量正在变得更加集中。ICANN曾试图计算，一半互联网用户在上网时能“看到”多少个DNS解析器。如下图所示，2020年用户几乎可以看到250个解析器农场。如今这一数字刚刚低于150个。同样，杜兰德不确定原因，但怀疑DNS解析器运营商的数量可能在减少，而剩余的可见解析器属于科技巨头。®
Pointlessly busy DNS servers also matter because ICANN thinks the number of DNS service providers is becoming more concentrated. ICANN has tried to calculate how many DNS resolvers half of internet users can “see” when they are online. As the graph below shows, users could see almost 250 resolver farms in the year 2020. That figure is just under 150 today. Again, Durand isn’t sure why but suspects the number of DNS resolver operators might be shrinking and that the remaining visible resolvers belong to tech giants. ®
