# Measuring the Centrality of DNS Infrastructure in the Wild
## 6 Name Server Centrality Analysis
### The Configuration and Behavior of Name Server  
Distinguishing the relationship of name servers accurately is a challenging task. After filtering the name servers with the same second-level domain, we sort through the combinations of NS providers manually.  
**Finding 4: More than 98% of all domain names apply a single name server provider, and even when multiple providers are used, the combination of providers is limited.** Compared to 75% revealed by previous studies [21], the rate of domain names that depend on a single name server provider has grown significantly, which shows an increase in the centrality of domain name delegation. We only discovered less than 3 million domain names that configure multiple NS providers. In addition, we found the combination of NS providers is limited, and the top 10 combinations cover more than 50% of domain names that apply multiple NS providers. That is to say that most domain owners tend to choose the same combination of providers. Even if multiple NS providers are selected, it does not mean that they are free from security risks caused by centrality. Table 8 demonstrates the hidden relation of NS providers in the IP infrastructure they rely on, even 6 out of the top 10 combinations share their IP infrastructure.  
**Finding 5: Invalid NS influences the availability of domain names.** Due to 98% of domain names only using one provider, when the _invalid rate_ of NS providers equals 1,  
\begin{table}
\begin{tabular}{l c c} \hline \hline
**IP Provider** & **IP \#** & **NS Provider \#** \\ \hline OVH SAS & 55,693 & 70,097 \\ UNIFIEDLAYER-AS-1 & 45,629 & 40,423 \\ Hetzner Online GmbH & 28,441 & 32,507 \\ AMAZON-02 & 14,013 & 25,847 \\ DIGITALOCEAN-ASN & 13,468 & 18,649 \\ LIQUIDWEB & 12,298 & 12,751 \\ PRIVATESYSTEMS & 11,343 & 8036 \\ IONOS SE & 10,130 & 9874 \\ CLOUDLARENET & 10,071 & 13,127 \\ Linode, LLC & 9329 & 11,199 \\ \hline \hline \end{tabular}
\end{table}
Table 7: Top 10 IP infrastructure providers.  
\begin{table}
\begin{tabular}{l c c} \hline \hline
**Combination of NS Providers** & **Domain Name \#** & **Shared Name Server** & **Shared IP Provider** \\ \hline nsone.net; squarespacedns.com & 1,393,701 & - & - \\ dnsnw.com; nagor.cn; nagor.com.cn & 53,756 & DNSPOD.NET & - \\ dan.com; undeveloped.com & 29,444 & CLOUDLARE.COM & AMAZON-02 \\ worldnic.com; register.com & 19,346 & - & NETWORK SOLUTIONS HOSTING \\
72 dns.com; idcl.cn & 15,882 & 72 DNS.COM & WeiYi Network Technology Co,Ltd \\ beointrendica.com & 14,258 & - & PT. Beon Intermedia \\ jagoanhosting.com & 12,246 & DNSFAMILY.COM & Chinanet \\ cultradns.[org; com; net; biz]; nsone.net & 12,023 & - & - \\ nsone.net; cloudflare.com & 11,798 & - & - \\ babies-fluffy.com; form-potato.com & 8818 & DNSV.JP & ARTERIA Networks Corporation \\ \hline \hline \end{tabular}
\end{table}
Table 8: Top 10 combinations of NS providers.  
we can judge that the domain names cannot be resolved. We found 382,995 NS providers whose _invalid rate_ equals 1, which affects 2,018,181 domain names.  
We summarized the possible reasons for the invalid NS:  
1. Placeholder. Special setting by providers is for certain purposes, such as domain parking and expired domain.
2. TLD typo. A typo unintentionally in TLD is caused by the owner of domain names, such as \(chuck.ns.cloud flare.comm\) and \(crystalvpn.xyz2\).
3. Nonexistent TLD. The owners configure a nonexistent TLD, such as \(corey.ns.cloud flare\).
4. IP address. The owners configure an IP address as NS records, including normal IP, private IP, and invalid IP.
5. Public DNS. The owners apply public DNS as NS records, which may fail to resolve the domain name.
6. Replaced or disabled NS. The owners of domain names replace or stop the original NS, but forget to clean the zone file, which may lead to potential security risks [39].