Why Your DNS Queries Are Often Sent Twice: APNIC Labs Reveals Widespread Duplication

In a recent episode of the PING podcast, APNIC’s Chief Scientist Geoff Huston shared a surprising finding from the organization’s global measurement infrastructure: nearly every DNS query he sees is duplicated, often within a very short time frame. DNS, or the Domain Name System, is the internet’s phonebook, translating human-friendly domain names like ‘example.com’ into machine-readable IP addresses. Every time you visit a website, stream a video, or use an app, your device sends out DNS queries to find the server. But it turns out, those queries are frequently sent more than once.

APNIC Labs runs an advertising-based measurement system that embeds unique DNS queries into ads shown across roughly 30 million browsers, games, and devices each day. When a device loads one of these ads, it also triggers a DNS lookup for a unique, one-time-use domain name. This allows the labs to track how DNS queries are handled around the world, revealing patterns of internet behavior without tracking users’ personal browsing. On a typical day, the system observes about 150 million distinct DNS labels, meaning unique domain names, but records approximately 270 million incoming DNS queries. That’s a duplication rate of nearly 1.8 to 1.

So why does this happen? The answer lies in a mix of technical and behavioral factors. First, intermediary systems like web proxies or caching servers can see a request and reissue it on behalf of the user, leading to additional DNS lookups. For example, if you’re on a corporate network, a proxy might fetch a page for you and then another internal system might check it again. Second, browser behavior can contribute: tabs left open can periodically refresh or re-fetch resources, causing the same DNS query to be sent again. Even simple user actions like clicking a link twice can produce multiple queries.

But there’s a more fundamental reason rooted in the design of DNS itself. DNS has always operated with an assumption of unreliability, packets can get lost, and servers might not respond. When a query fails, the client will retry. With the introduction of DNSSEC (Domain Name System Security Extensions), which adds digital signatures to DNS records to prevent spoofing, retries become even more likely. If a DNSSEC validation fails, for instance, because a resolver can’t verify the signature chain, it may return a SERVFAIL error, prompting the client to ask again, often to a different resolver. Huston pointed out that many users have multiple resolvers behind the scenes, some with DNSSEC enabled, some without, and the client may retry across them. Thus, duplicate queries are not just accidental repetitions; they are part of the system’s normal fault-tolerance mechanisms and are themselves an aspect of what the measurement system is testing.

The APNIC team dug deeper into the patterns of duplication and found several recurring types, which they discuss in the podcast. While the specific patterns weren’t detailed in the blog post, the implication is clear: DNS query duplication is pervasive and can reveal a lot about a user’s network setup, how many resolvers they use, whether DNSSEC is active, and even the presence of caching proxies. For the average internet user, this means that their ISP or network operator might be seeing far more DNS traffic than necessary, and each query is a potential leak of browsing activity.

This has direct privacy implications. If your DNS queries are not encrypted, as is the case with traditional DNS over port 53, every duplicated query can be observed by anyone on the network path, from your internet provider to public Wi-Fi operators. They can see which sites you’re trying to visit, even if you don’t ultimately connect to them. Worse, because duplicates may go to different resolvers or be retried after a SERVFAIL, your browsing footprint is spread across multiple logging points. In an era where DNS data is increasingly used for profiling and targeted advertising, reducing unnecessary exposure is critical.

One powerful mitigation is to use encrypted DNS, which wraps your queries in a secure layer so that intermediaries cannot read them. Protocols like DNS over HTTPS (DoH) and DNS over TLS (DoT) send your DNS traffic encrypted, making it look like regular web traffic (DoH) or using a dedicated secure channel (DoT). Even if queries are duplicated, the content is hidden. For users, switching to a privacy-first encrypted DNS service like AEU DNS ensures that all DNS transactions, including those extra retries, are shielded from prying eyes. AEU DNS supports both DoH and DoT, operates with a strict no-logging policy, and blocks known malicious domains, providing a triple benefit of privacy, security, and peace of mind.