On this page
An open DNS resolver is a server that will resolve a name for anyone who asks. A one-off scan in 2018 found about 2.74 million that offered recursion and returned the right answer (Park, Jang, Mohaisen and Mohaisen, IEEE/ACM Transactions on Networking, 2022). A count says how many will answer. It doesn't say whose networks they sit on, or what else their addresses do.
So we took the working open resolvers in DNS Resolver IP for the week of October 10 to 16 and matched them against our network and proxy databases on October 17.
What the week holds
DNS Resolver IP has every host answering DNS on UDP port 53, flagged for recursion and for whether it's a working open resolver. For the week, each host by its latest reply:
| In the week | Hosts |
|---|---|
| Answered DNS on UDP port 53 | 3,177,270 |
Advertised recursion, recursion_available | 932,803 |
Resolved correctly, answer_correct | 811,734 |
Refused, rcode 5 | 1,814,347 |
answer_correct marks "a working open recursive resolver with no DNS manipulation", in the docs' words, and it's what this post means by a working open resolver.
Nine in ten are on ISP networks
Each resolver's network is the one announcing its address in IP ASN, and its type is the one our ASN database gives that network:
| Network type | Working open resolvers | Share | Networks |
|---|---|---|---|
| ISP | 722,122 | 89.0% | 15,524 |
| Hosting | 51,569 | 6.4% | 2,445 |
| Education | 25,386 | 3.1% | 713 |
| Business | 9,313 | 1.1% | 1,560 |
| Government | 3,229 | 0.4% | 494 |
ISP is the type of access, mobile and transit networks, the ones that connect people. Hosting networks, where servers sit, hold one in sixteen.
By the country each network is registered in, the resolvers span 219 countries, and ten of them hold 58.1%:
AS58224, Iran Telecommunication Company, holds 38,809 of Iran's 48,772, the most on any one network, and all but six of Algeria's 13,507 are on Telecom Algeria. Bangladesh's 55,737 are spread over 649 networks.
| Network | Country | Working open resolvers |
|---|---|---|
| AS58224 Iran Telecommunication Company | Iran | 38,809 |
| AS4766 Korea Telecom | South Korea | 28,177 |
| AS4134 Chinanet | China | 19,940 |
| AS4538 China Education and Research Network | China | 19,924 |
| AS209 CenturyLink | United States | 19,267 |
| AS8048 CANTV | Venezuela | 18,702 |
| AS4812 China Telecom | China | 16,390 |
| AS36947 Telecom Algeria | Algeria | 13,501 |
| AS4837 China Unicom | China | 13,185 |
| AS12389 Rostelecom | Russia | 12,851 |
One in seven is a residential proxy exit
109,798 of the 811,734, 13.5%, are on Residential Proxy IP's 90-day list of October 17: seen as residential proxy exits between July 19 and October 16. 46,733, 5.8%, were seen as exits in the same week, on the 7-day list.
Hosts that answer DNS but refuse to resolve are on the lists far less often:
| Hosts | On the 90-day list | On the 7-day list | |
|---|---|---|---|
| Working open resolvers | 811,734 | 13.5% | 5.8% |
| ...on ISP networks | 722,122 | 14.9% | 6.3% |
| Hosts that refused | 1,814,347 | 1.3% | 0.4% |
| ...on ISP networks | 446,909 | 4.9% | 1.5% |
1,273,703 of the hosts that refused are on hosting networks, where proxy exits are rare, so the fair comparison is within ISP networks: there an open resolver is three times as likely to be on the 90-day list. It holds network by network. On the 230 ISP networks with at least 100 of each, the open resolvers' share is the higher one in 201, and across them they're 3.3 times as likely to be on the 90-day list and 3.5 times on the 7-day list.
An open resolver is an amplifier for anyone who can forge a source address: in tests at the University of Twente, an ANY query for a name with a 12 KB answer was amplified 153.7 times. One that's on Residential Proxy IP as well answers for strangers twice, their DNS queries and their traffic through a proxy network.
Resolvers that answer with the wrong address
9,933 of the hosts that advertised recursion answered with a loopback, private or zero address, an address Iran's censorship uses, or a public resolver's own address:
| Answer | Resolvers |
|---|---|
Loopback, 127.0.0.1 for all but four | 3,641 |
Private: 10.0.0.1 1,870, 192.168.1.1 638, others 608 | 3,116 |
10.10.34.36, and 10.10.34.34 or .35 for four | 2,283 |
1.1.1.1 | 576 |
0.0.0.0 | 312 |
8.8.8.8 | 5 |
10.10.34.36 is one of the private addresses Iranian networks answer with for a blocked name: OONI's measurements found dns.adguard.com resolving to it on an Iranian ISP (RIPE 85, 2022). 2,160 of the 2,283 that returned one of the three are on networks registered in Iran, 1,939 of them on AS58224. 3,570 of the 127.0.0.1 answers come from Amazon's AS16509 and AS14618.
Finding them on your networks
DNS Resolver IP is a gzipped CSV, so finding the open resolvers on networks you run is a filter: the rows in your prefixes, or in IP ASN's ranges for your AS numbers, with answer_correct set. A row with recursion_available set and rcode 5 advertises recursion but refuses queries from outside, which is what a resolver for your own users should do. For traffic coming in from consumer lines, match the address against both databases.
How we counted
The week is every host in DNS Resolver IP that answered between 00:00 UTC on October 10 and 00:00 UTC on October 17, 2026, each by its latest reply in the week, all of them IPv4. The file itself holds 90 days, one row per host with its first_seen and last_seen: 6,756,915 hosts in the October 17 build. An address on a consumer line can change hands in 90 days, so one router can show up under several, and a week is the rows whose last_seen falls in it. Network type and country are the origin AS's, from IP ASN and ASN as built on October 16, and the proxy lists are Residential Proxy IP's of October 17. The network-by-network figures are Mantel-Haenszel ratios over the 230 ISP networks with at least 100 working open resolvers and 100 hosts that refused.
DNS Resolver IP is rebuilt weekly, and its docs list the columns. To license it, see pricing or talk to us.
