RECORD TYPE=NULL Records In DNSDB Mtbl Files

The report analyzes two weeks of DNSDB mtbl data (Jan 10–23, 2017) to quantify and characterize DNS NULL record traffic, showing that large volumes stem from DNS tunneling services—principally Your-Freedom (via domains such as 1yf.de, 2yf.de, 53r.de) and TunnelGuru/SlowDNS (clusters of short .in domains)—alongside DNSSEC measurement traffic (dashnxdomain.net) and assorted low-volume domains. It outlines scalable data extraction workflows (merge vs. parallel processing), enumerates the most frequent second-level domains, and demonstrates attribution via passive DNS and WHOIS/reverse-WHOIS to infer tunneling activity.