Operator Perspectives on DNS Resolver Security Practices

DNS is susceptible to attacks such as cache poisoning, DDoS amplification, and privacy leakage. Despite the availability of defenses like DNSSEC, QNAME minimization, and source‐port randomization, adoption has remained surprisingly low. This study investigates the persistent gap between recommended DNS security practices and their practical implementation by examining how human factors and organizational constraints influence resolver operators' security decisions across diverse operational contexts. Through semi-structured interviews with resolver operators from diverse organizations, we identify key usability and operational barriers: configuration complexity that increases the risk of errors, performance-security tradeoffs that lack clear guidance, limited threat visibility that diminishes urgency, and the absence of contextual decision support. Operators frequently prioritize availability over proactive defenses and navigate organizational structures with distributed responsibilities and limited coordination. These factors contribute to the persistent under-deployment of known security mechanisms. Our findings inform the design of more usable DNS security tools and implementation strategies that better align with the constraints and mental models of operators.