Beyond the surface: The three layers of DNS resilience that keep websites online

When you type a website address into your browser, a behind-the-scenes system called the Domain Name System (DNS) quickly translates that human-friendly name into a machine-readable IP address. This process is often taken for granted, but the infrastructure that holds the official address records for a domain, its authoritative DNS, is far more intricate than a simple list on a single server. A new study accepted to the ACM SIGMETRICS 2026 conference peels back the layers of this complexity, examining how the resilience of authoritative DNS can make or break the availability of online services.

At first glance, you might picture authoritative DNS as one computer storing domain-to-IP mappings. In reality, the paper’s authors, led by Minzhao Lyu of the University of New South Wales, describe a logical three-layer structure. The top functional layer defines the roles: a primary nameserver holds the master copy of the domain’s zone file, the authoritative record of all its addresses and settings, while one or more authoritative nameservers answer queries from internet users. Below that, each server gets a name (like ns1.example.gov.au), and at the deepest level, each named server exists as multiple instances identified by unique IP addresses, often spread across different locations and networks.

Getting this infrastructure right and keeping it running involves three distinct operational phases. First, infrastructure placement decides who operates each server instance, where it is physically located, and which IP addresses it uses. For resilience, it is critical to choose operators in different geographic regions and avoid placing all instances in a single data center. Second, service configuration sets up how accessible and redundant those servers are, for instance, ensuring multiple instances can handle queries if one fails and that firewall rules do not block legitimate traffic. The third phase, operation, focuses on secure data handling: using secure zone transfer mechanisms like AXFR (a protocol for copying zone files between primary and authoritative servers) and implementing DNSSEC. DNSSEC, short for Domain Name System Security Extensions, adds cryptographic signatures to DNS records, preventing attackers from forging responses to redirect users to fake websites.

To see how well real-world domains apply these principles, the researchers developed a scoring system and applied it to 273 online public services run by Australian federal government departments. They gathered data from public DNS records, IP registration databases, and third-party intelligence. The findings, visualized in a comprehensive matrix, show that while most government domains scored well on infrastructure placement, meaning their servers are reasonably distributed, their service configuration lagged behind. In plain terms, many lacked sufficient redundancy and were not configured to remain accessible during network failures or natural disasters. For instance, it was common to see multiple authoritative nameserver names, but those names often resolved to IP addresses in the same network or geographic area, providing a false sense of redundancy. Even where record distribution from primary to authoritative servers appeared robust, the final link to end users was often weak. The culprit: missing or incorrectly implemented DNSSEC, which left the door open to tampering with DNS answers. Many domains had DNSSEC partially enabled but with expired signatures or incomplete chains of trust, rendering the security measure ineffective.

This data-driven framework gives both policymakers and domain operators a clear view of hidden systemic risks. Instead of reacting to outages, they can proactively identify gaps. For website owners, especially those running critical services, the message is clear: simply having multiple nameservers is not enough. True resilience requires careful placement, consistent configuration, and cryptographic protections like DNSSEC. The study underscores that DNS is not just a plumbing detail but a foundational security layer. Operators should regularly audit their DNS setup: verify server IP diversity, confirm consistent responses from all authoritative servers, monitor DNSSEC signature validity, and conduct failover tests by simulating server downtimes.

While the research targets those who manage domains, everyday internet users also have a stake in DNS security. By choosing a privacy-first DNS resolver such as AEU DNS, users can ensure that their own queries are encrypted and handled by a trusted provider, reducing the risk of eavesdropping or manipulation in transit. However, to close the loop, website operators must do their part and fortify their authoritative DNS infrastructure. Together, secure resolution and robust authoritative setup create a safer internet.