The Domain Name System (DNS) is a fundamental component responsible for the translation of domain names into IP addresses. Traditional DNS relies on centralised authorities for domain registration and resolution, raising concerns about censorship, security, and trust. In response to these challenges, blockchain-based DNS (BDNS) solutions have emerged, promising decentralisation, security, and resilience. This paper reviews existing works on BDNS and their potential to transform the domain name landscape. Each BDNS solution is analysed in terms of its objectives, operational mechanisms, supported Top Level Domains (TLD) and limitations. The state of the art of BDNS is discussed to identify the key challenges hindering its widespread adoption, ranging from technical dificulties (scalability, performance, integration with existing infrastructure) to security concerns, and to governance and regulatory considerations.
The DNS is a hierarchical, distributed database that enables the resolution of domain names to IP addresses on the Internet. It is implemented through a hierarchy of multiple servers, also known as Name Servers, that work together to resolve domain names.
The traditional DNS architecture sufers from numerous problems. One notable issue is the vulnerability to several cyberattacks, including distributed denial-of-service (DDoS) attacks as well as other attacks such as cache poisoning attacks that can potentially lead to integrity concerns. These vulnerabilities arise primarily due to the centralised nature of the traditional DNS, where a single point of failure can compromise the entire system. Additionally, the traditional DNS lacks transparency and accountability. Indeed, the decision-making processes regarding domain registrations, updates, and resolutions often occur within the closed circles of domain registrars, leaving end-users with limited visibility into how these decisions are made. These weaknesses highlight the urgent need for innovative solutions to strengthen the security, resilience, and trustworthiness of the DNS ecosystem.
In response to these vulnerabilities, several approaches have been proposed. One such solution
involves implementing security extensions such as Domain Name System Security Extensions
(DNSSEC) [
Blockchain-based DNS (BDNS) introduces blockchain technology to address the limitations of the traditional DNS architecture. Blockchain is a decentralised and immutable ledger that records transactions across a network of nodes securely and transparently. By applying blockchain principles to DNS, BDNS eliminates the reliance on centralised authorities, thus mitigating the risk of single points of failure and enhancing the system’s resilience against cyberattacks. Moreover, BDNS provides a tamper-proof record of domain ownership and associated DNS records, strengthening transparency and accountability in the domain registration process. Through the use of smart contracts and cryptographic techniques, BDNS enables automated and trustless domain management. Furthermore, BDNS ofers the potential to address concerns related to censorship and domain ownership conflicts (e.g trademark disputes or expired domains) by providing a decentralised and censorship-resistant infrastructure.
The integration of blockchain technology into the DNS protocol represents a significant advancement in functionality and security. Several alternatives to BDNS have been proposed to date. One novel contribution of this paper is to provide a comprehensive overview of currently active and notable BDNS solutions, explaining their primary objectives, functionalities, and limitations. Additionally, this paper contributes with a unique discussion of the BDNS landscape and the primary factors limiting its potential for widespread adoption.
The rest of the paper is organised as follows. Section 2 introduces the basics of DNS and blockchain. Existing academic works that review the state of the art of BDNS are discussed in Section 3. An extensive analysis of existing BDNS solutions is presented in Section 4. Section 5 identifies the main challenges to the adoption of BDNS. Finally, Section 6 concludes the paper.
DNS serves as a fundamental component of the Internet infrastructure, translating humanreadable domain names into IP addresses, enabling users to access websites and services consistently. Introduced by Paul Mockapetris in 1983, DNS has played a crucial role in simplifying the user experience by replacing numerical IP addresses with easily memorable domain names. DNS operates on a hierarchical and centralised model, where a set of authoritative servers (name servers) manage domain name records for specific zones. DNS data (DNS records) is stored in local databases but is available worldwide. DNS is an application layer protocol that allows computers, hosts, routers, and name servers to communicate and resolve names (translate names into IP addresses). DNS-lookup is a basic function of the protocol, performed by any machine or service, and results from remote name servers are temporarily stored in local memory to improve performance.
DNS Structure. Figure 1 highlights the hierarchical structure of DNS [
The DNS Protocol. DNS operates on a client-server model and employs a hierarchical and
distributed protocol to simplify the translation of domain names into IP addresses [
If the requested domain name is not found in the local cache or the cache entry has expired, the resolver acts recursively. It queries root DNS servers to determine the authoritative DNS server responsible for the TLD of the requested domain name (e.g., ".com", ".org"). After receiving a response from the root DNS server specifying appropriate the TLD server, the resolver queries the TLD server for information about the domain name’s authoritative name server. Once the resolver receives a response from the TLD server with the IP address of the authoritative DNS server, it queries the authoritative DNS server for the IP address of the domain name’s authoritative name server.
Once the authoritative name server provides the IP address, the recursive resolver caches this information to optimise subsequent queries for the same domain. The IP address is then relayed to the user’s device, enabling it to establish a connection with the desired web server. Domain Name Registration. Domain name registration involves the process through which individuals or entities acquire the rights to use a specific domain name within the DNS. This process is demonstrated in Figure 3 where registries, under the oversight of the IANA and administered by ICANN, are responsible for managing TLDs such as ‘.com’ and ‘.net’. Their primary function involves the maintenance of records about domain ownership, attributing individual domains to respective registrants, whether they be individuals or organisations. This hierarchical structure defines the distribution of responsibilities within the DNS, ensuring the orderly management of Internet resources.
Registrars, act as intermediaries between end-users (registrants) and registries, and are responsible for performing transactions related to domain registrations. For instance, when a registrar wants to sell a TLD to another end-user, it is required to inform the corresponding registry (e.g. VeriSign for ‘.com’ domains). Subsequently, the registrar incurs a fee payable to the registry, a cost that is typically embedded within the price charged to the end-user.
The registration process often involves choosing the desired registration period which usually
ranges from 1 to 10 years [
Blockchain technology refers to a decentralised, digital ledger that records transactions across a network of computers. It operates as a global public ledger, in which participants (called nodes) can determine the ownership of assets without the need for a central authority or intermediary to validate transactions. The public ledger, which is replicated across all nodes in the network, is trusted as the oficial record. The blockchain is constructed independently by all nodes in the network, rather than a single entity. As a result, each node in the network can independently validate the data communicated through the network and create a duplicate of the same public ledger, ensuring a secure and transparent system.
Transactions and Blocks. A transaction serves as the fundamental unit of data exchange within the network, representing the transfer of value or information from one participant to another, cryptographically signed by the sender for authentication. Once initiated, transactions undergo validation and verification by network nodes before being grouped into blocks. Each block contains a header with metadata uniquely identifying the block. Each block also maintains a reference to its preceding block by including the hash value of the previous block in its header, forming a sequential chain of blocks. This linkage ensures the integrity and immutability of the transaction history, with any attempt to tamper with the data in a block requiring alteration of subsequent blocks, thus providing a secure and transparent ledger of transactions within the blockchain network.
Distributed Ledger. The blockchain is a distributed ledger that uses a linked list of blocks containing a chronological record of transactions. Each node within the blockchain network maintains a copy of the data associated with the blockchain. The accumulation of blocks results in the concept of a height, which refers to the distance from the genesis block, and the top block, referring to the most recently added block in the chain.
Consensus. Consensus is a method employed by the participants of a Blockchain network
to reach agreement on the current state of the public ledger, which maintains a record of all
transactions [
A few attempts have been made in the literature to survey existing research on BDNS.
Weihong et al. [
The work by Bansal and Sethumadhavan [
In their work, Patsakis et al. [
Contrarily to the above-mentioned works, this paper systematically discusses goals, operational mechanisms and limitations of the main active BDNS systems as well as relevant academic works. Furthermore, it includes a unique analysis of the challenges to overcome to foster the widespread adoption of BDNS.
The application of blockchain technology within the DNS has been recognised as one of the proposed mechanisms for improving security within the DNS protocol and mitigating instances of censorship. In this survey, we focus on exploring the landscape of BDNS and the advancements made in this field. In conducting this research on blockchain DNS solutions, our criteria for selecting existing works emphasised relevance, publication quality, impact and popularity. We prioritised works directly addressing BDNS solutions, published in reputable academic journals or conference proceedings, and demonstrating innovative approaches or significant contributions to the field. Furthermore, we emphasised including works that are currently active within the research community, alongside those that have gained widespread recognition and citation. Through this approach, we aimed to present a comprehensive overview of both active and influential research in the field of blockchain DNS, providing a clear understanding of the current state and future directions. In this section, we present these approaches, highlighting their key characteristics, identifying limitations, as well as areas of research that remain to be explored. We extensively analyse each solution separately, and in Table 1 we summarise the main features of the discussed BDNS approaches.
Namecoin [
Mechanism. Namecoin based on the Bitcoin codebase [
2https://www.namecoin.org/docs/electrum-nmc/ ensuring censorship resistance and tamper-proof domain records.
Challenges. Namecoin was the first BDNS to ofer security and decentralisation. However,
its primary limitation stems from inadequate support and adoption, leading to insuficient
computing power. This makes Namecoin more vulnerable to 51% attacks compared to other
analogous systems [
Blockstack [
Challenges. Scalability is a fundamental concern to many blockchain solutions, and as Blockstack’s user base and transaction volume increase, maintaining eficiency and speed on its blockchain may become a formidable challenge. Blockstack DNS operates on the Bitcoin blockchain, which has limitations in terms of transaction throughput and block size. As the number of domain registrations and updates increases, the blockchain may become congested, leading to delays in processing DNS transactions and higher transaction fees. Additionally, the reliance on a public blockchain like Bitcoin could pose scalability challenges as the network grows, potentially impacting the performance and responsiveness of the Blockstack DNS system.
Ethereum Name Service (ENS) [
Mechanism. ENS operates on the Ethereum blockchain to provide a decentralised domain registration and management system. Managing the .eth TLD, ENS is not compatible with traditional DNS. Critical data such as domain registrations, and ownership details are securely stored on the Ethereum blockchain. To interact with ENS, users deploy Ethereum wallet software, like MetaMask 4, which integrates seamlessly with ENS features. Users can perform various actions such as registering, updating DNS records, transferring domain ownership, and conducting DNS lookups via their Ethereum wallets. This method ensures a decentralized and secure approach to managing Ethereum-based domain names. It’s worth noting that while some operations like ENS lookups may suggest a transactional process with associated costs, they actually function as read operations and do not require any transactions or fees. Challenges. A significant challenge for ENS is the gas fees during network congestion that can potentially impact the system’s operations, particularly for users attempting to register, update, or transfer domain names. During periods of high network congestion on the Ethereum blockchain, gas fees can increase dramatically as users compete to have their transactions processed by miners. This can make ENS operations prohibitively expensive for users, especially for those with limited resources or smaller transactions. Additionally, the unpredictability of gas fees during network congestion can introduce uncertainty for users, making it challenging to plan and budget for ENS transactions efectively. This uncertainty may result in delays or hesitancy in executing critical actions, such as renewing domain registrations or updating DNS records, which could disrupt the normal operation of decentralised applications (dApps) and services relying on ENS.
Handshake 5 is a decentralised, permissionless naming protocol with a core objective of revolutionising the traditional DNS. Its primary goal is to create an alternative to existing Certificate Authorities and naming systems by establishing a decentralised and censorship-resistant DNS infrastructure. Handshake seeks to democratise domain ownership, providing users with increased control over their digital identities and mitigating issues related to centralised control and censorship in the current DNS landscape.
Mechanism. Handshake naming protocol has its own dedicated blockchain, distinct from traditional DNS. Introducing various custom TLDs such as .hs, Handshake operates independently of traditional DNS, allowing users to create and manage domains on its blockchain. The blockchain stores ownership details, utilising a decentralised and secure system for tamper-resistant records. Interactions with Handshake occur through specialised wallet software like Namebase 6, enabling users to participate in blind auctions using HNS tokens for domain registration. DNS record updates, domain ownership transfers, and DNS lookups are executed through trans
5https://hsd-dev.org/files/handshake.txt 6https://www.namebase.io/ actions on the Handshake blockchain, providing a decentralised and secure environment for managing and trading Handshake domain names.
Challenges. The main challenge of the Handshake DNS lies in achieving interoperability with the traditional DNS infrastructure. While Handshake ofers a decentralised naming system, integrating it seamlessly with existing DNS servers and resolvers poses complexities. One key challenge is ensuring compatibility between Handshake’s decentralised model and the hierarchical structure of the traditional DNS. This involves developing protocols and standards that allow Handshake names to be resolved by conventional DNS servers and browsers without compromising security or performance.
Unstoppable Domains [
Mechanism. Unstoppable Domains operates on various blockchain networks, including
Ethereum and Zilliqa 7. Managing unique blockchain-based TLDs like .crypto and .zil,
Unstoppable Domains operates independently from traditional DNS. Vital domain information,
including ownership records, is stored on the Ethereum blockchain, ensuring immutability and
resistance to censorship. Users interact with Unstoppable Domains through compatible wallets
like MetaMask, while DNS lookups for these domains are made through decentralised resolution
protocols. These protocols involve querying the Ethereum blockchain or other smart contracts
that contain the domain name records. The registration process involves a one-time fee and
submitting a transaction on the Ethereum blockchain to associate the chosen domain with the
user’s Ethereum address, providing a secure and transparent domain ownership experience.
Challenges. Similarly to ENS, the main challenge faced by Unstoppable Domains is the
potential volatility of gas fees on the Ethereum blockchain. During periods of high network
congestion or elevated gas prices, such as significant network activity, the cost of gas fees can
increase significantly. For instance, findings in [
Mechanism. B-DNS is designed with a four-layer architecture. At the Data Layer, DNS records are stored as immutable transactions in the blockchain, utilising operation records for registration, update, and revocation functionalities. Inspired by Bitcoin’s scripting system, these records enable dynamic domain ownership changes and content updates. The Index Layer ofers search speed by maintaining an index tree mapping domain names to IP addresses, with bloom filters facilitating fast revocation checks. In the Consensus Layer, a PoS consensus protocol ensures the consistency of DNS records, with block generators selected based on stake proportional probabilities. Finally, the Network Layer is responsible for the communication between B-DNS name servers, recursive resolvers, and end-users, enabling direct querying of DNS records from the blockchain and ensuring compatibility with the traditional DNS systems. Challenges. Mitigating DDoS attacks in B-DNS presents a notable challenge despite the detection of fewer vulnerabilities compared to traditional DNS. In particular, the security analysis that was performed saw that while in traditional DNS 24 vulnerabilities that can lead to DDoS attacks were detected, in B-DNS only 12 vulnerabilities were detected. However, it is essential to recognise that this improvement does not necessarily indicate that B-DNS efectively prevents DDoS attacks. Instead, B-DNS architecture may render it more resilient to such attacks, making it more challenging for attackers to exploit vulnerabilities and disrupt domain resolution processes. Nonetheless, the potential for DDoS attacks to disrupt B-DNS operations remains a concern, highlighting the need for continued research and development to increase the system’s defenses against such threats.
BlockZone [
Mechanism. BlockZone operates by using smart contracts on the Ethereum blockchain to manage DNS resource records, hierarchical relationships, and historical updates. Four types of smart contracts - Consensus Contract (CC), Relationship Contract (RC), Ownership Contract (OC), and History Record Contract (HC) - are utilised for this process. When adding a new node (name server) to the system, registration involves submitting an application to the blockchain network, undergoing confirmation by the consensus contract, and creating relationship contracts if approved. Data updates are managed by synchronising resource records in the external InterPlanetary File System (IPFS) 8 system and sending information to the service contract, which records updated domain name information and generates historical contracts. Data retrieval involves end users initiating query requests, trusted servers querying the blockchain’s service contract, and verifying the integrity of retrieved information. A consensus algorithm, a variant of PBFT, integrates communication and verification processes among participating nodes, enhancing eficiency and reducing network overhead.
Challenges. While BlockZone demonstrates notable improvements in parser throughput, authentication eficiency, and distribution of query requests, several limitations exist within the system. Firstly, the centralised structure of the root servers presents a potential single point of failure risk, particularly evident when cache misses occur, leading to frequent query requests directed to them. This centralised architecture contrasts with BlockZone’s non-central design philosophy, potentially undermining the system’s reliability and resilience. Additionally, while BlockZone utilises the PBFT consensus algorithm to ensure eficient transaction processing, the rapid increase in blockchain length due to frequent updates poses a challenge in terms of storage overhead. As the number of server nodes increases (for the needs of new domain storage), so does the overall storage load on the blockchain. Thus, while BlockZone ofers significant improvements in authentication eficiency, challenges persist in managing the storage overhead and maintaining system reliability in the face of potential centralisation risks.
The reviewed BDNS solutions are among the most active and relevant research eforts to date in the implementation of a BDNS. While alternative concepts have been proposed, the insuficient maturity of their research currently limits us from gathering suficient information on them. Considering the current availability of materials and resources, we present a brief overview of some of these additional concepts, with the expectation of further research in the future.
EmerDNS 9 operates on the Emercoin blockchain [
AuthLedger [
BDNS Name
Objectives
Mechanisms
Supported TLD
Limitations Namecoin Handshake Blockstack ENS Unstoppable Domains B-DNS Blockzone
Decentralised domain registration, censorship resistance
Bitcoin blockchain, .bit Blockchain-based registration, Decentralised naming protocol, alternative to Certificate Authorities Decentralised internet, user control over data Simplify interaction with Ethereum, human-readable smart contract addresses Censorship-resistant domains, usercontrolled
Handshake blockchain, Blockchain-based auction system Bitcoin blockchain .hs .id .podcast .helloworld Ethereum blockchain
.eth Ethereum and Zilliqa blockchains,
.crypto .zil Prevent cache poison- Agnostic blockchain, ing and DDoS at- 4-layer architecture tacks Address central- Ethereum blockchain isation issues of traditional DNS architecture and management
Agnostic Agnostic
Insuficient computing power, integration, scalability, regulatory scrutiny Usability, integration, competition with existing DNS, regulatory scrutiny Usability, integration, scalability, regulatory considerations Usability, integration, name resolution speed, regulatory considerations High gas fees, integration, industry acceptance, regulatory considerations Vulnerable to DDoS attacks Single point of failure risk, storage overhead an authentication scheme, and does not allow for the purchase of individual domain names.
DNSLedger [
BlockONS [
ConsortiumDNS [
The integration of blockchain into DNS is a notable attempt to reform the Internet infrastructure,
ofering decentralisation, and user empowerment. However, this transformative potential comes
with several challenges that must be carefully considered to realise the full benefits of BDNS
solutions. In this section, the multifaceted challenges to the adoption and implementation of
BDNS are explored. From scalability and performance concerns to regulatory and governance
hurdles, each challenge represents a promising research direction to explore further.
Scalability. One of the biggest challenges in BDNS is scalability. Traditional DNS systems
handle a vast number of queries daily, and scaling blockchain solutions to accommodate similar
or higher loads while maintaining performance is non-trivial. The consensus mechanisms
and distributed nature of blockchains often result in slower transaction processing times and
limited throughput, hindering their ability to handle DNS queries at scale. For example, in 2007,
The CryptoKitties craze clogged the Ethereum network, causing congestion and significantly
increasing transaction fees [
Performance. Performance is closely related to scalability and is another significant challenge
for BDNS. The decentralised nature of blockchain networks introduces latency compared to
centralised DNS systems, potentially impacting user experience. Improving the performance of
blockchain networks through optimisations in consensus algorithms, network infrastructure,
and caching mechanisms is essential for wider adoption. Bitcoin’s blockchain is well known
for its slow transaction processing times and high fees during periods of network congestion
[
Security. While blockchain technology ofers various security benefits, it also introduces
new security challenges for DNS systems. Smart contract vulnerabilities, consensus algorithm
weaknesses, and the potential for 51% attacks are among the security threats that BDNS systems
must mitigate. Ensuring the integrity of DNS data stored on the blockchain is crucial to prevent
unauthorised access or tampering. The decentralized autonomous organization (DAO) hack on
the Ethereum blockchain [
Governance and regulatory considerations. Regulatory challenges pose significant barriers to the adoption of BDNS. The decentralised nature of blockchain networks complicates regulatory compliance and governance, particularly concerning domain ownership, dispute resolution, and legal liability. Establishing clear regulatory frameworks and standards for BDNS systems is essential to address these challenges and foster trust among stakeholders. Conflicting regulations and lack of clarity have created barriers to entry for startups and innovators in the space.
Usability and adoption. Usability is a critical challenge for BDNS adoption. User-friendly graphical interfaces, integration with existing DNS infrastructure, and compatibility with popular browsers and applications are essential to encourage widespread adoption. Moreover, educating users and DNS administrators about the benefits and complexities of BDNS is necessary to overcome scepticism and resistance to change. Some BDNS solutions sufer from poor user experience and lack of adoption due to complex registration processes, unfamiliar interfaces, and limited support from traditional DNS providers.
Integration with existing infrastructure. Integrating BDNS with existing infrastructure presents technical challenges such as ensuring compatibility with legacy systems and protocols. Interoperability between BDNS solutions and traditional DNS infrastructure is essential for a smooth transition and to minimise disruptions to existing services. Incompatibility issues between BDNS solutions and traditional DNS infrastructure can lead to interoperability challenges and disruptions in service. For example, DNS resolvers may struggle to resolve blockchain domain names or may not support DNSSEC for blockchain domains, creating confusion and inconvenience for users [34].
The concept of BDNS seems a promising solution in the attempt of trying to make the Internet more secure and resilient to censorship. The investigation into BDNS solutions reveals a wide range of objectives, mechanisms, and limitations. However, the journey toward widespread adoption of BDNS is not without challenges. Integration challenges with existing Internet infrastructure, scalability concerns, and the need for regulatory landscapes further highlight the complexity of implementing BDNS on a large scale. Additionally, usability remains a common hurdle, as users who adopt traditional DNS may find the transition challenging. Addressing these concerns will be crucial for the success of these transformative technologies.
This work was partially supported by the UK Research and Innovation (DTP Scholarship under grant EP/T517859/1); and the Academic Centre of Excellence in Cyber Security Research University of Southampton (EP/R007268/1). [34] A. Herzberg, H. Shulman, Dnssec: Security and availability challenges, in: 2013 IEEE Conference on Communications and Network Security (CNS), IEEE, 2013, pp. 365–366.