Awesome article! Interesting related work is in [1], where we used DNS TTLs as a covert channel for passing data, without needing to control the domain(s) bein

Awesome article! Interesting related work is in [1], where we used DNS TTLs as a covert channel for passing data, without needing to control the domain(s) being used. Through the development of that covert channel, we found a variety of idiosyncrasies such in the client-side DNS infrastructure and discussed them in [2]. Some devices will report an erroneously high TTL, some will unnecessarily shorten the TTL, some represent entire clusters of DNS resolvers with interesting properties, and so on. Based on your work, it appears that over the past five years, the number of open resolvers has dropped dramatically, from ~30M to ~3M. Your email response really is indicative of some of the folks that get cranky when you send them packets :) [1]: http://research.tom.callahan.us/pubs/icsi-tr-12-002.pdf http://research.tom.callahan.us/pubs/icsi-tr-12-002.pdf [2]: http://research.tom.callahan.us/pubs/imc029-schompAemb.pdf http://research.tom.callahan.us/pubs/imc029-schompAemb.pdf