ICANN warns of ISPs tripling DNS traffic with multi-resolver requests

Practice described as 'belt and suspenders' approach, potentially harmful if adopted widely

By LineZotpaper

Published21 October 2026

Read Time2 min

Internet governance body ICANN has identified a new source of unnecessary strain on the domain name system: internet service providers that send every customer DNS query to three different resolvers simultaneously. The finding, presented at ICANN's annual conference in Bali, Indonesia, follows a similar issue with Google's Chrome browser that once generated half of all DNS root server traffic before being resolved.

ICANN's Office of the Chief Technology Officer shared data from its Identifier Technology Health Indicators (ITHI) research program on Monday, revealing an unusual pattern among some ISPs. Principal technologist Maud Durand said the affected ISPs send every single DNS query three times: to Google, to Cloudflare, and to another DNS resolver. "Every single DNS query is sent three times: to Google, to Cloudflare, and to another DNS resolver," Durand said, labelling it a "belt and suspenders" approach.

While specifying primary and secondary DNS resolvers is standard practice for resilience, the triple-query approach goes far beyond what is necessary, as DNS resolvers are already highly reliable. Durand noted that the ISPs send requests over both IPv4 and IPv6, repeating non-cached requests within 100 milliseconds for about half of queries, with a further 30 percent repeated within 30 seconds.

"It is hard to know if it is a bug or a specific behaviour," Durand said, suggesting the practice may stem from an inability to hire skilled internetworking engineers, leading to a brute-force approach to resilience. ICANN is investigating the cause.

Durand contrasted this with the earlier "Chromiods" flaw in Chrome, where well-meaning efforts to avoid a form of DNS hijacking caused the browser to generate about half of all DNS root server traffic during 2020. After pressure from ICANN and other stakeholders, Google gradually fixed the issue, reducing Chrome's share of root server traffic from 45 percent to one percent, which Durand described as "in the noise."

While the ISPs involved are not major players, ICANN warns that if the practice becomes widespread or is adopted by a large entity, it could have a significant negative impact. The organisation is also concerned about increasing concentration among DNS service providers, with the number of resolver farms visible to half of internet users falling from almost 250 in 2020 to under 150 today.

Analysis

Why This Matters

Unnecessary DNS traffic strains the root server infrastructure that underpins the entire internet, potentially affecting browsing speeds and reliability for all users.
ICANN's data shows DNS resolver concentration is increasing, meaning fewer providers control critical infrastructure. If a large ISP adopts this triple-query practice, the impact on root servers could be substantial.
The finding reveals broader challenges in internet governance: well-intentioned but poorly-designed resilience measures can inadvertently harm the system they aim to protect.

Background

ICANN (Internet Corporation for Assigned Names and Numbers) coordinates the domain name system globally. The DNS root servers are the top of the hierarchy, translating human-readable domain names into IP addresses. In 2020, a flaw in Google's Chromium browser caused Chrome to generate about half of all root server traffic through repeated DNS queries, a problem that was gradually fixed after pressure from ICANN and other stakeholders. Now a new pattern has emerged: some ISPs are sending each DNS query to three separate resolvers simultaneously, tripling the load. This practice appears to be an attempt to maximise resilience but is technically unnecessary and potentially harmful.

Key Perspectives

ICANN: The organisation views this triple-query practice as unusual and potentially problematic. It is investigating whether the behaviour is a bug or intentional, and is concerned that if adopted by larger ISPs it could degrade DNS performance for everyone. Affected ISPs (not identified): The ISPs appear to prioritise extreme resilience, possibly due to staffing shortages in internetworking engineering. From their perspective, minimising downtime may justify the extra traffic. Critics/Skeptics: Some might argue that DNS infrastructure is already highly resilient and that such practices are wasteful. There is also concern that ICANN's focus on reducing root server traffic could hamper legitimate efforts to improve DNS performance or security.

What to Watch

ICANN's ongoing research into the cause of this behaviour and whether it is a bug that can be patched.
Whether any major ISPs adopt similar multi-resolver practices, which would trigger a more urgent response.
The trend in DNS resolver concentration: if the number of visible resolver farms continues to shrink, the internet's resilience could become more fragile.

Sources

Nervous ISPs replace Chrome as strange consumers of DNS resources · www.theregister.com - Articles

Checked

11 claims in this story checked against 1 source: 9 supported.

Show each claim

SupportedISPs are sending each customer DNS query three times, tripling the requests.www.theregister.com - Articles: ““Every single DNS query is sent three times: to Google, to Cloudflare, and to another DNS resolver,” Durand said”
SupportedThe practice could have a significant negative impact if it becomes widespread or a large entity adopts it.www.theregister.com - Articles: “ICANN feels the ISPs using this practice aren’t major players, but the org worries that if the practice becomes widespread, or is adopted by a large entity, it could have a nasty impact.”
Partly supportedThe ISPs send each query to three resolvers simultaneously.www.theregister.com - Articles: ““Every single DNS query is sent three times: to Google, to Cloudflare, and to another DNS resolver,” Durand said”
SupportedDurand called the practice a “belt and suspenders” approach.www.theregister.com - Articles: ““Every single DNS query is sent three times: to Google, to Cloudflare, and to another DNS resolver,” Durand said, labelling this practice a “belt and suspenders” approach”
SupportedDurand said, “It is hard to know if it is a bug or a specific behaviour.”www.theregister.com - Articles: ““It is hard to know if it is a bug or a specific behaviour,” Durand said”
SupportedThe requests go over IPv4 and IPv6; about half of non-cached queries are repeated within 100 milliseconds, and a further 30 percent within 30 seconds.www.theregister.com - Articles: “The ISPs ICANN has spotted send DNS requests over IPv4 and IPv6, and for non-cached requests repeat them within 100 milliseconds for about half of queries. A further 30 percent repeat within thirty seconds.”
SupportedThe Chrome “Chromiods” flaw generated about half of all DNS root server traffic during 2020.www.theregister.com - Articles: ““Chromiods” the odd flaw in Chrome that meant well-meaning efforts to avoid a form of DNS hijacking caused the browser to generate about half of all DNS root server traffic during the year 2020.”
SupportedAfter pressure from ICANN and other stakeholders, Google gradually fixed the Chrome issue.www.theregister.com - Articles: “ICANN, plus other internetworking and governance stakeholders, told Google to sort it out. Durand said the Chocolate Factory gradually did.”
SupportedChrome’s share of DNS root server traffic fell from 45 percent to one percent, which Durand described as “in the noise.”www.theregister.com - Articles: “Durand shared the graph below which shows the browser’s share of DNS root server traffic falling from 45 percent to one percent today. Or as Durand described it, “in the noise.””
Partly supportedThe ISPs involved are not major players.www.theregister.com - Articles: “ICANN feels the ISPs using this practice aren’t major players”
SupportedThe number of resolver farms visible to half of internet users fell from almost 250 in 2020 to under 150 today.www.theregister.com - Articles: “users could see almost 250 resolver farms in the year 2020. That figure is just under 150 today.”