Temporal Evaluation of Secure DNS Resolvers Against Malicious Domain Threat Feeds
Resumo
Public recursive DNS resolvers with security filtering provide a transparent protection layer, but their blocking behavior depends on threat-intelligence sources and update policies. We temporally evaluated Quad9 Malware, CleanBrowsing Security, Cloudflare Security, and AdGuard DNS against CERT.pl and URLhaus corpora. Quad9 and CleanBrowsing showed high agreement with CERT.pl, whereas agreement with URLhaus was lower and varied over time. Because CERT.pl discloses that Quad9 uses its Warning List, the results indicate resolver-feed alignment rather than feed-independent superiority. The study provides an auditable protocol for corpus-specific analysis and discusses limitations related to feed provenance, sampling, and external observability.
Referências
Antonakakis, M., Perdisci, R., Dagon, D., Lee, W., and Feamster, N. (2010). Building a dynamic reputation system for {DNS}. In 19th USENIX Security Symposium (USENIX Security 10).
CERT Polska (2025). Warning list. [link]. Accessed: 2026-03-22.
Fujii, S. and Sato, T. (2025). 10 pdnss 10 colors: A measurement study of protective dns. Journal of Information Processing, 33:608–618.
IBGE (2024). Em 2023, 88,0% das pessoas com 10 anos ou mais utilizaram internet. [link]. Agência de Notícias do IBGE.
Liberato, M., Affinito, A., Meijerink, B., Jonker, M., Botta, A., and Sperotto, A. (2025). To block or not to block? evaluating parental controls across routers, dns services, and software. In 2025 9th Network Traffic Measurement and Analysis Conference (TMA), pages 1–10.
Liu, M., Zhang, Y., Li, X., Lu, C., Liu, B., Duan, H., and Zheng, X. (2024). Understanding the implementation and security implications of protective dns services. In NDSS.
Manasrah, A. M., Khdour, T., and Freehat, R. (2022). Dga-based botnets detection using dns traffic mining. Journal of King Saud University-Computer and Information Sciences, 34(5):2045–2061.
Silva, M., Franco, M., Scheid, E., Zembruzki, L., and Granville, L. (2023). Desempenho de resolvedores de dns públicos: Uma análise do estado da arte. In Anais da XX Escola Regional de Redes de Computadores, pages 43–48, Porto Alegre, RS, Brasil. SBC.
Silva, M. A. d., Franco, M. F., Scheid, E. J., Zembruzki, L., and Granville, L. Z. (2024). Perfresolv: A geo-distributed approach for performance analysis of public dns resolvers based on domain popularity. In International Conference on Advanced Information Networking and Applications (AINA 2024), volume 200 of Lecture Notes on Data Engineering and Communications Technologies, pages 35–47, Cham, Switzerland. Springer.
Voloshina, I. (2024). Domain name analysis with machine learning: Enhancing efficiency and reducing analyst strain. Master’s degree in computer science - ict innovation cyber security, Università di Trento & University of Twente.
