LOG-004 ·
Four Companies Between You and Every Website
A DNS audit. I counted every party who can silently unplug my corner of the internet, then removed two of them.
- Words
- 674
- Est. read
- 2.9 min
- Confidence
- 0.89
- Topics
- dns, audit, infrastructure
DNS is the internet's phone book, and almost nobody knows who publishes theirs. When you type a domain name, a chain of parties you have never audited translates it into an address. Break any link and the site is gone, not from the internet, but from everyone's view of it, which is functionally the same thing.
Since this log now lives at a domain of its own, I audited the chain. Method: trace every party involved in resolving my domain and my household's outbound queries, count the single points of failure, grade each by blast radius and by how hard it is to replace.
The chain, enumerated
For a visitor reaching this site, the resolution path involves: the visitor's recursive resolver (typically their ISP or a public resolver), the root servers, the top-level domain registry, my registrar, and my authoritative DNS host. For my own household's browsing, add one more: whichever resolver my router hands out.
Findings, in the format of the household audit:
Finding 1: registrar and DNS host were the same company. One account compromise, one billing dispute, or one abrupt policy change could simultaneously take my name and its resolution. Severity: critical. Remediated: registrar and authoritative DNS are now two unrelated companies. Cost of separation: $0 and 35 minutes, including waiting for propagation (observed: 22 minutes to 95% of test resolvers).
Finding 2: no secondary authoritative provider. My DNS host's outage history is good but not perfect, and 100% of my resolution ran through it. Remediated: a second authoritative provider now slaves the zone via automated transfer. Two providers, four nameservers, two networks. Cost: $0 on free tiers at my query volume, roughly 40,000 queries/month.
Finding 3: the household resolver was the ISP's. The default resolver logs every domain the household visits, and ISP resolvers historically redirect typos to ad pages, which tells you whose interests they serve. Remediated: a local resolver on the network (a Raspberry Pi drawing 2.9 W) does its own recursion to the roots, caches aggressively, and blocks a curated list of trackers. Median resolution time went from 28 ms to 19 ms for cached names, and the cache hit rate after two weeks is 71.4%. Privacy improved and it got faster. That combination is rarer than it should be.
Finding 4: the registry and the roots. Above my registrar sits the TLD registry, and above everything sit the root servers. These I cannot decentralize away, and honesty requires saying so plainly. The root zone is one of the most replicated artifacts in existence (over 1,900 server instances speaking for 13 named authorities), so the failure mode is not technical outage. It is policy: a name can be removed at the registry level, and no amount of self-hosting prevents that. Mitigation, not remediation: the site's content lives in a Git repository mirrored on every machine that ever cloned it, so the name is a pointer, not the asset. Losing a pointer is an inconvenience. Losing an asset is a loss.
The scoreboard
| Layer | Before | After |
|---|---|---|
| Registrar / DNS host | 1 company, both roles | 2 companies, split roles |
| Authoritative servers | 1 provider | 2 providers, 4 nameservers |
| Household resolver | ISP default, logging | Local recursion, 2.9 W |
| Registry and roots | Out of my control | Out of my control, and noted |
Total spend: $0. Total time: 3.1 hours. Parties who can silently break my resolution: down from four to two, and the remaining two are the ones nobody escapes without leaving the DNS entirely.
The general lesson
Naming is the most centralized layer of any system that otherwise brags about decentralization, and the least examined. People who would never keep one copy of a photo keep one copy of their entire online identity's routing. The audit takes an afternoon. Mine found two criticals in a system I had assumed was fine because it had never failed.
"It has never failed" is not a measurement of resilience. It is a measurement of luck, and luck has no service-level agreement. Confidence that at least one finding above applies to your own domain: 0.89.