DNS Query Performance and Resolution Times
This dataset provides granular DNS resolver performance metrics across carrier infrastructures, including query rates, resolution times, cache efficiency, DNSSEC validation, anycast routing, and DDoS attack detection. It enables network operators, security analysts, and researchers to monitor, benchmark, and optimize DNS services while identifying security threats and performance bottlenecks.
Sample rows
preview · 8 of 711 rows · all 16 columns| record_idstring | ddos_attack_typestring | cache_hit_ratiofloat | ddos_attack_detectedboolean | location_countrystring | resolver_idstring | timestampdatetime | qpsfloat | average_resolution_time_msfloat | nxdomain_response_countinteger | dnssec_validation_success_countinteger | dnssec_validation_failure_countinteger | anycast_routing_efficiencyfloat | carrier_namestring | location_citystring | location_statestring |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| rec-00001 | Amplification | 0.97 | true | USA | srv-US01 | 2024-06-15T01:13:22Z | 512.1 | 6.4 | 18 | 3380 | 9 | 0.96 | Comcast | Dallas | TX |
| rec-00002 | blank | 0.93 | false | UK | resolver-UKLON1 | 2024-06-15T02:45:10Z | 387.4 | 8.2 | 22 | 2912 | 7 | 0.94 | BT Group | London | blank |
| rec-00003 | UDP Flood | 0.99 | true | Germany | edge-DEHAM | 2024-06-15T03:57:41Z | 645.8 | 5.1 | 16 | 4012 | 6 | 0.98 | Deutsche Telekom | Hamburg | blank |
| rec-00004 | blank | 0 | false | USA | srv-US02 | 2024-06-15T04:21:55Z | 0 | 0 | 0 | 0 | 0 | 0 | AT&T | Atlanta | GA |
| rec-00005 | blank | 0.77 | false | Australia | resolver-AU01 | 2024-06-15T05:08:27Z | 80 | 15.6 | 39 | 1110 | 8 | 0.82 | Telstra | Sydney | NSW |
| rec-00006 | blank | 0.88 | false | Canada | srv-CA01 | 2024-06-15T06:29:54Z | 255 | 11.8 | 25 | 1750 | 13 | 0.87 | Rogers | Toronto | ON |
| rec-00007 | blank | 0.55 | false | Brazil | edge-BR01 | 2024-06-15T07:55:13Z | 33.3 | 43.2 | 67 | 850 | 11 | 0.66 | Oi | Rio de Janeiro | RJ |
| rec-00008 | DNS Flood | 0.99 | true | India | resolver-INBOM | 2024-06-15T08:42:26Z | 710.2 | 4.8 | 28 | 4158 | 5 | 0.99 | Airtel | Mumbai | MH |
| rec-00009 | blank | 0.03 | false | USA | srv-US03 | 2024-06-15T09:24:57Z | 0.7 | 400.1 | 2 | 8 | 1 | 0.01 | Verizon | Chicago | IL |
| rec-00010 | blank | 0.84 | false | Japan | edge-JP01 | 2024-06-15T10:37:11Z | 199.9 | 19.2 | 17 | 1180 | 10 | 0.85 | SoftBank | Tokyo | blank |
| rec-00011 | Reflection | 0.96 | true | France | resolver-FR01 | 2024-06-15T11:02:55Z | 478.6 | 7.3 | 21 | 3100 | 8 | 0.95 | Orange | Paris | blank |
| rec-00012 | blank | 0.92 | false | Mexico | srv-MX01 | 2024-06-15T12:16:43Z | 320.9 | 9.4 | 24 | 1980 | 14 | 0.91 | Telmex | Mexico City | CDMX |
| rec-00013 | blank | 0.18 | false | South Africa | edge-ZA01 | 2024-06-15T13:29:33Z | 13.5 | 75.6 | 41 | 112 | 20 | 0.21 | MTN | Johannesburg | GP |
| rec-00014 | blank | 0.81 | false | China | resolver-CN01 | 2024-06-15T14:41:09Z | 98.4 | 22.1 | 34 | 1075 | 7 | 0.8 | China Telecom | Shanghai | blank |
| rec-00015 | DNS Flood | 1 | true | USA | srv-US04 | 2024-06-15T15:52:26Z | 823.5 | 3.9 | 12 | 4200 | 4 | 1 | Spectrum | Los Angeles | CA |
| rec-00016 | Zero-Day | 0.95 | true | Italy | resolver-IT01 | 2024-06-15T16:10:19Z | 478.6 | 6.7 | 14 | 3199 | 5 | 0.94 | TIM | Rome | blank |
| rec-00017 | blank | 0.92 | false | Spain | edge-ES01 | 2024-06-15T17:25:44Z | 387.4 | 7.5 | 19 | 2720 | 8 | 0.91 | Telefonica | Madrid | blank |
| rec-00018 | blank | 0.85 | false | Australia | srv-AU02 | 2024-06-15T18:38:12Z | 150.7 | 17.8 | 30 | 920 | 9 | 0.82 | Optus | Melbourne | VIC |
| rec-00019 | blank | 0.01 | false | Kenya | resolver-KE01 | 2024-06-15T19:41:05Z | 1 | 9999.9 | 7 | 3 | 6 | 0.01 | Safaricom | Nairobi | blank |
| rec-00020 | SYN Flood | 0.98 | true | USA | srv-US05 | 2024-06-15T20:53:48Z | 645.8 | 5.5 | 20 | 3950 | 6 | 0.98 | Frontier | Seattle | WA |
What the 711 rows show
from the 711-row sample- 23%ddos_
attack_ detected = true - 0.81median cache_
hit_ ratio - 61location states
- 146location cities
- 170carrier names
- 186.2median qps
Median 0.81, from 0.0 to 1.0.
- string 7
- integer 3
- float 4
- datetime 1
- boolean 1
Columns
16 columns in four groups| column | type | description | example |
|---|---|---|---|
| Text 7 columns | |||
record_id | string | Unique identifier for each DNS performance recordunique | rec-00001 |
resolver_id | string | Identifier for the DNS resolver (e.g., server name or IP) | srv-US01 |
ddos_attack_type | string | Type of DDoS attack detected (if any); empty if none6 types · optional | Amplification |
carrier_name | string | Name of the carrier or ISP operating the DNS resolver | Comcast |
location_city | string | City where the DNS resolver is locatedoptional | Dallas |
location_state | string | State or province where the DNS resolver is locatedoptional | TX |
location_country | string | Country where the DNS resolver is located | USA |
| Numbers 7 columns | |||
qps | float | Queries per second handled by the resolver during the measurement interval0 or more | 512.1 |
average_resolution_time_ms | float | Average DNS resolution time in milliseconds0 or more | 6.4 |
cache_hit_ratio | float | Ratio of DNS queries resolved from cache (0-1)0 to 1 | 0.97 |
nxdomain_response_count | integer | Number of NXDOMAIN responses (non-existent domain queries) in the interval0 or more | 18 |
dnssec_validation_success_count | integer | Number of DNSSEC validations that succeeded0 or more | 3380 |
dnssec_validation_failure_count | integer | Number of DNSSEC validations that failed0 or more | 9 |
anycast_routing_efficiency | float | Efficiency score for anycast routing (0-1, higher is better)0 to 1 | 0.96 |
| Dates and times 1 column | |||
timestamp | datetime | Date and time when the metrics were recorded | 2024-06-15T01:13:22Z |
| True or false 1 column | |||
ddos_attack_detected | boolean | Indicates if a DDoS attack was detected during the interval | true |
Use it for
A telecommunications dashboard
The ddos_
attack_ detected rate, cache_ hit_ ratio by ddos_ attack_ type and a breakdown of location_ country. Excel, Power BI or Tableau. Why do 164 of 711 rows have ddos_
attack_ detected = true? A class exercise
Hand out the rows and one question. Everyone works from the same 711 rows.
- Records711rec-000010.97Amplific…rec-000020.93—rec-000030.99UDP Flood
A software demo
Believable records with resolver_
id, timestamp and qps to fill a screen in front of a buyer.
This dataset711 rows16 columns
Yours1,000 rows16 columnslocation_city: UK only
blueprint · dns-query-performance-and-resolution-times
Behind this dataset
Same schema. As many rows as you need.
These 711 rows came out of a blueprint — 16 columns with generation rules behind each one. Open it in Data Factory to retune a column, add your own, wire in foreign keys, and run it at the size you actually need.
Rules it was built with
- DNS resolver instance ID and anycast IP address
- Query rate: queries per second (QPS) and peak QPS
- Resolution time in milliseconds (target <20ms for recursive queries)
- Cache hit ratio percentage (higher is better, reduces upstream queries)
- Query type distribution: A, AAAA, MX, TXT, SRV, PTR records
- NXDOMAIN (non-existent domain) response rate for typos/malware
- DNSSEC validation: signed vs. unsigned responses, validation failures
- DDoS attack indicators: query flood, amplification attacks
Open the blueprint in Data Factory
1 credit per row. Preview 20 rows free. Buy rows for the full run.
- Exports
- CSV, JSON, JSONL, Parquet, SQL, Excel, TSV, XML
- Licence
- yours to use, including commercially
- API slug
- dns-query-performance-and-resolution-times