Poster: Measuring Non-PTR Use in the IPv6 Reverse DNS Namespace

Abstract

The ip6.arpa namespace is the authoritative reverse DNS tree for IPv6. Although primarily intended for reverse lookup, it also permits other uses. The extent and distribution of non-PTR content in this namespace remain poorly understood. We present the first systematic measurement of the IANA-delegated ip6.arpa hierarchy. We verify 21,999 /32 zones, approximately 11.37 million /48 zone cuts, and 5.68 million /56 zone cuts separated from 35.25 million wildcard-synthesized responses. Among the /48 zones, 5.48 million return at least one apex record. Among 26,251 IP addresses observed in A and AAAA records, 125 are flagged by VirusTotal as malicious or suspicious. Flagged IP addresses serve as apex A targets for 149,372 of 1.13 million /48 zones.