Black Holes and Prisoners: Understanding AS112 Deployment Characteristics

Elizabeth Boswell; Xinyan Xian; Mingshu Wang; Stephen McQuistin; Colin Perkins

Black Holes and Prisoners: Understanding AS112 Deployment Characteristics

Elizabeth Boswell, Xinyan Xian, Mingshu Wang, Stephen McQuistin, Colin Perkins

School of Computer Science

Research output: Contribution to conference › Paper › peer-review

Abstract

AS112 is a distributed, volunteer-run, anycast DNS service that acts as a sink for leaked DNS queries for local resources, preventing them from overloading core DNS infrastructure. AS112 helps protect important parts of the Internet infrastructure, but there has been no comprehensive study of who runs the AS112 servers, where they are located, and whether they effectively capture leaked queries. Using RIPE Atlas and 33646 open recursive resolvers, we detect 469 AS112 sites, run by 97 operators, and compare the response time and query distances of AS112 to root server queries. AS112 performs well, with 23.21% lower median response times and 36.11% lower median distances than the root. However, AS112 is dependent on a small number of large operators (one operator serves 41.71% of probes in our study), limiting its resilience.

Original language	English
Publication status	Published - 23 Mar 2026
Event	Passive and Active Measurement Conference - Virtual Duration: 23 Mar 2026 → 25 Mar 2026 Conference number: 2026 https://pam2026.at

Conference

Conference	Passive and Active Measurement Conference
Abbreviated title	PAM
Period	23/03/26 → 25/03/26
Internet address	https://pam2026.at

Cite this

@conference{3fc2b5ddbccc48789465b446708b83bd,

title = "Black Holes and Prisoners: Understanding AS112 Deployment Characteristics",

abstract = "AS112 is a distributed, volunteer-run, anycast DNS service that acts as a sink for leaked DNS queries for local resources, preventing them from overloading core DNS infrastructure. AS112 helps protect important parts of the Internet infrastructure, but there has been no comprehensive study of who runs the AS112 servers, where they are located, and whether they effectively capture leaked queries. Using RIPE Atlas and 33646 open recursive resolvers, we detect 469 AS112 sites, run by 97 operators, and compare the response time and query distances of AS112 to root server queries. AS112 performs well, with 23.21\% lower median response times and 36.11\% lower median distances than the root. However, AS112 is dependent on a small number of large operators (one operator serves 41.71\% of probes in our study), limiting its resilience.",

author = "Elizabeth Boswell and Xinyan Xian and Mingshu Wang and Stephen McQuistin and Colin Perkins",

year = "2026",

month = mar,

day = "23",

language = "English",

note = "Passive and Active Measurement Conference, PAM ; Conference date: 23-03-2026 Through 25-03-2026",

url = "https://pam2026.at",

}

TY - CONF

T1 - Black Holes and Prisoners: Understanding AS112 Deployment Characteristics

AU - Boswell, Elizabeth

AU - Xian, Xinyan

AU - Wang, Mingshu

AU - McQuistin, Stephen

AU - Perkins, Colin

N1 - Conference code: 2026

PY - 2026/3/23

Y1 - 2026/3/23

N2 - AS112 is a distributed, volunteer-run, anycast DNS service that acts as a sink for leaked DNS queries for local resources, preventing them from overloading core DNS infrastructure. AS112 helps protect important parts of the Internet infrastructure, but there has been no comprehensive study of who runs the AS112 servers, where they are located, and whether they effectively capture leaked queries. Using RIPE Atlas and 33646 open recursive resolvers, we detect 469 AS112 sites, run by 97 operators, and compare the response time and query distances of AS112 to root server queries. AS112 performs well, with 23.21% lower median response times and 36.11% lower median distances than the root. However, AS112 is dependent on a small number of large operators (one operator serves 41.71% of probes in our study), limiting its resilience.

AB - AS112 is a distributed, volunteer-run, anycast DNS service that acts as a sink for leaked DNS queries for local resources, preventing them from overloading core DNS infrastructure. AS112 helps protect important parts of the Internet infrastructure, but there has been no comprehensive study of who runs the AS112 servers, where they are located, and whether they effectively capture leaked queries. Using RIPE Atlas and 33646 open recursive resolvers, we detect 469 AS112 sites, run by 97 operators, and compare the response time and query distances of AS112 to root server queries. AS112 performs well, with 23.21% lower median response times and 36.11% lower median distances than the root. However, AS112 is dependent on a small number of large operators (one operator serves 41.71% of probes in our study), limiting its resilience.

M3 - Paper

T2 - Passive and Active Measurement Conference

Y2 - 23 March 2026 through 25 March 2026

ER -

Black Holes and Prisoners: Understanding AS112 Deployment Characteristics

Abstract

Conference

Fingerprint

Cite this