Temporal Evaluation of Secure DNS Resolvers Against Malicious Domain Threat Feeds - Souza, Jaqueline Gonçalves de; Molinos, Diego Nunes; Ribeiro, Thiago Pirola (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais do XXVI Simpósio Brasileiro de CibersegurançaDO - 10.5753/sbseg.2026.29392, 2026)
Public recursive DNS resolvers with security filtering provide a transparent protection layer, but their blocking behavior depends on threat-intelligence sources and update policies. We temporally evaluated Quad9 Malware, CleanBrowsing Security, Cloudflare Security, and AdGuard DNS against CERT.pl and URLhaus corpora. Quad9 and CleanBrowsing showed high agreement with CERT.pl, whereas agreement with URLhaus was lower and varied over time. Because CERT.pl discloses that Quad9 uses its Warning List, the results indicate resolver-feed alignment rather than feed-independent superiority. The study provides an auditable protocol for corpus-specific analysis and discusses limitations related to feed provenance, sampling, and external observability.