Poster: Behavioral Fingerprinting for Identifying DNS Resolver Families and Version Groups

Abstract

Identifying deployed DNS resolver software supports Internet measurement, vulnerability assessment, and upgrade planning, but explicit probes such as "version.bind" are often disabled or falsified. We investigate whether ordinary DNS responses provide behavioral fingerprints for resolver identification. In a controlled Docker environment, we deploy 32 versions of BIND9, Unbound, Knot Resolver, and PowerDNS Recursor and extract features including packet structure, TTLs, DNS flags, EDNS(0), and EDE. Because individual responses provide limited information, multiple responses are aggregated into session-level statistical fingerprints. A two-stage model first identifies the resolver family and then predicts behaviorally distinguishable version groups. Under default configurations, family identification achieves 100% accuracy; version-group accuracy is 100% for BIND9, Knot, and PowerDNS and 92.3% for Unbound. These results demonstrate the feasibility of resolver identification from ordinary responses while highlighting potential sensitivity to configuration, cache state, and measurement conditions.