Research on inconsistent consecutive DNS responses from DNS resolvers

As the core infrastructure of the Domain Name System (DNS), DNS resolvers play a vital role on the Internet. DNS responses are used for message transmission between DNS resolvers and clients. Their correctness and normalization directly affect whether clients can access the Internet safely and accurately. Therefore, the research on DNS responses returned by DNS resolvers is significant to ensure Internet security. We found that when some DNS resolvers received multiple consecutive identical DNS queries, they returned DNS responses with inconsistent headers. We believe that research on this phenomenon can provide a more comprehensive understanding of the behavior of DNS resolvers. This paper proposes a method to comprehensively discover the phenomenon by collecting and analyzing the DNS responses. In addition, this paper also proposes a method to verify our two speculations about the reasons for the phenomenon. The experimental results confirmed the credibility of one of the speculations that a specific configuration of the DNS resolvers caused them to add header sections with a specific meaning when responding to the DNS queries from the cache.