Massive DNS Query Duplication Found by APNIC, 38% of Queries Repeated Unnecessarily

The internet's Domain Name System (DNS), often called the phonebook of the internet, is built on a foundation of free and open queries. But a new measurement study from APNIC Labs reveals that this freedom has led to widespread overuse, with more than a third of all DNS queries being unnecessary duplicates. The phenomenon, documented on a single day in June 2026, exposes a classic ‘tragedy of the commons’ where the lack of cost per query encourages recursive resolvers to flood authoritative servers with repeated requests.

Using data from its global measurement platform, which embeds unique DNS names into online advertisements to test resolution paths, APNIC Labs collected over 259 million queries on 1 June 2026. The system directs users from six regions (East Asia/Oceania, North America, Latin America, Europe/West Asia, Indian Subcontinent, and China/Hong Kong/Macao) to geographically nearby authoritative servers that always respond promptly to A and AAAA queries. Because each measurement uses a unique DNS name and a short time-to-live (TTL) of 60 seconds, caching cannot absorb the queries, ensuring that every duplicate seen at the authoritative server reflects a fresh repetition.

The headline finding is stark: 38% of all unique query name and query type couplets were duplicated at least once, and duplicate queries accounted for 43% of total query volume. Regional variations were pronounced. Users in the Indian Subcontinent experienced a 61% duplication rate for query names, and those in the China/Hong Kong region saw 47%. Europe and North America fared better at 27% and 28% respectively, though even these lower figures far exceed the expected 2% duplication that would arise from normal UDP datagram loss.

Digging into the timing of duplicates, the study found that 45% of all duplicate queries arrived within 10 milliseconds of the original. This rapid-fire pattern points to systematic ‘back-to-back’ querying, not the occasional retry after a slow timeout. Further peaks appear at 60, 120, 180 and 240 seconds, matching the TTL expiry, suggesting some resolvers also perform unnecessary cache refreshes even when no new user request triggers them. The most duplicated single query in the 24-hour window was repeated a staggering 8,771 times at the Frankfurt authoritative server.

By examining the IP addresses of the resolvers sending these rapid duplicates, the researchers uncovered several motivations. In 82% of cases, the duplicate came from a different IP address than the original, often from a different recursive resolver or even a different network. About 40% of duplicating query sets involved both IPv4 and IPv6, indicating a race between the two protocols. Around 5% splayed queries across multiple autonomous systems (ASes), and 16% used known open resolvers. Yet 14% of the rapid duplicates came from the very same resolver IP address, a behavior that is hard to justify as anything other than wasteful over-querying.

A list of the top 25 networks hosting such aggressively duplicating resolvers reveals a mix of telecommunications providers and a few large cloud companies. Indian ISP Reliance Jio Infocom led with 14% duplicate query names out of over 20 million total queries; other notable names include BHARTI Airtel, Viettel, VNPT, Deutsche Telekom, and Cloudflare. Some networks, like Bell Canada and Optimum Telecom Algeria, showed duplication rates above 90%, though on smaller total volumes.

This mass duplication exacts a real cost: authoritative servers must process double (or more) the legitimate load, wasting energy and computing resources, and potentially slowing down responses for everyone. The study serves as a reminder that DNS, while robust, is a shared resource that depends on responsible behavior from all participants. For everyday users and businesses, opting for a privacy-first encrypted DNS service such as AEU DNS, which provides secure, no-logs resolution, can help ensure that your queries are not contributing to this hidden overload, as such services often employ responsible querying behaviors and modern protocols like DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) that inherently discourage misuse.