Methodology

From traffic to daily files

  1. A copy of the DNS traffic to the .nl authoritative servers goes to ENTRADA2, SIDN's open-source DNS data warehouse.
  2. ENTRADA2 reduces and structures the data and stores it in tables.
  3. Trino queries compute the RSSAC-002 metrics for each day.
  4. The results are written as YAML files and published here.

Data collection

We receive a copy of the DNS traffic to the .nl authoritative servers in ENTRADA2, which we use for research. We handle this data in accordance with EU and Dutch law, and publish only aggregated results (see below).

What ENTRADA2 does

ENTRADA2 reads the raw packet captures and turns them into a table where each row is one DNS exchange. Along the way it:

  • Matches each query with its response, into a single record.
  • Reduces the data by dropping what the analysis doesn't need, which makes it far smaller than the original captures.
  • Enriches each record with, among other things, geolocation, the sender's network (AS number), and whether the query came from a well-known public resolver.

The result is stored as Apache Parquet files in Apache Iceberg tables on S3-compatible storage. Any SQL engine that supports these formats can query it; we use Trino.

How the metrics are computed

The metrics are computed by an open-source tool, which is a fork of the original RSSAC002-TLD Metrics Generator on Codeberg. The original was built by bachelor students at TU Delft in their Software Project course, who developed it on their own ENTRADA2 instance, with their own traffic. Many thanks to them. Our fork adds support for selecting a TLD, OAuth2 authentication, and some fixes, which are listed in the README.

For each day (UTC), the tool runs a set of Trino queries and writes the results as YAML files: one for all servers combined, and one per server. Anyone running ENTRADA2 can use it on their own traffic and get files in the same format.

What we publish, and what we don't

The files contain only daily totals, such as the number of queries, responses per response code, and distinct source addresses. They contain no individual queries and no IP addresses. The unique-sources metric reports how many distinct addresses were seen, not which ones.

See Metrics for the full list and the file format.

Differences from the root servers' files

The files follow the RSSAC002v5 format, with two differences:

  • service field: nl_servers for all servers, or nl_servers-ns1.dns.nl for a single server, instead of a root server name such as b.root-servers.net.
  • Four of six metrics: the other two, zone-size and load-time, describe the distribution of the root zone and don't apply to .nl.

Missing days

If a day has no file, we have no data for it, for example because the capture or processing failed. It does not mean the servers received no queries.