Can the Netherlands' digital infrastructure withstand a knock?

Insight into the digital infrastructure

Dutch society is already highly dependent on the digital infrastructure, and its dependency will only increase over time. According to Statistics Netherlands, 96 per cent of people in the Netherlands made daily use of the internet in 2024: 10 percentage points up on 4 years earlier. What's more, internet use is by no means all for frivolous recreational purposes: 92.2 per cent of the population report using internet banking services at least once in the last 3 months. Given the internet infrastructure's importance to society, it's vital that the infrastructure's availability is high.

However, the internet community faces a problem in that context: we don't currently have adequate empirical insight into the resilience of the internet in the Netherlands. For example, while we do know the levels of server redundancy the authorities in various countries have built into their Domain Name Systems (DNSs), we don't know what measures organisations in other (vital) sectors have taken to assure the resilience of their DNS servers, or what the picture is across the .nl zone as a whole. Such measures are important, because almost all the online services we use on a daily basis are accessed by means of domain names. The non-availability of DNS servers therefore has direct implications for things such as our ability to send and receive e-mail and view websites.

The purpose of the study described here was therefore to increase insight, specifically from our perspective as experts in the field of the DNS and other core internet infrastructures. We hope that our work will be the first step towards the development of a body of methods for continuous automated resilience analysis of the Netherlands' digital infrastructure.

Measures for maximising the availability of DNS servers

The DNS community has developed a wide range of techniques for maximising the availability of DNS servers. We have chosen to focus on 3 measures that have been shown to be very effective for boosting resilience, which we have labelled A to C:

• Measure A DNS servers should be located in different networks so that the outage of a single network doesn't completely disable the service. In 2021, for example, a BGP fault caused the complete outage of Facebook's DNS service, because all the company's DNS servers were connected to the same network. If the servers had been distributed across multiple networks, at least some would have remained available.

• Measure B A given domain name's DNS servers should have IP addresses with multiple IP prefixes. If 2 servers share an IP prefix, that tends to mean that they're connected to the same infrastructure. They might be located in the same data centre, for example, implying that both will go down if the data centre suffers a power outage. Both servers will also be unreachable if the IP prefix is hit by a BGP hijack.

• Measure C DNS servers should ideally use anycast, a technique that allows servers at multiple internet locations to be accessed using the same IP address. The use of anycast increases a DNS service's ability to withstand DDoS attacks and location-related faults.

In the rest of this article, we will consider the extent to which those 3 measures are used by organisations in the Netherlands. Although there are other ways of reinforcing availability – including DDoS attack mitigation strategies (e.g. use of the NaWas) and the protection of networks against routing hijacks – they are outside the scope of our assessment. In the following analysis, the technical term 'autonomous system' (AS) is used instead of 'network'.

Research methods and datasets

Our investigation involved looking at the domain names of 700 organisations to establish whether our 3 focus measures were used to protect the availability of their public DNS servers, mail servers and web servers. We also made a similar analysis of all 6.2 million domain names under the .nl top-level domain.

In order to get a broad picture of the Netherlands' digital infrastructure, we used 5 datasets:

• The .nl zone file As the operator of the .nl top-level domain, SIDN has an overview of all .nl domain names. The .nl domain names to which name servers are linked are listed in a 'zone file', which SIDN manages. The .nl zone file is available only to SIDN and our research partners.

• EW magazine Top 500 We made use of a list of Dutch businesses and organisations compiled by EW magazine, known as the Top 500 list.

• CrUX list Google publishes a periodic Chrome User Experience Report (CrUX), which includes a list of the most popular websites, in terms of how frequently they are visited by Google Chrome browser users. The CrUX list is divided into 6 bands or 'buckets': the top 1,000, 5,000, 10,000, 50,000, 100,000 and 500,000.

• Register of government websites As we did for our 2022 study, we also made use of the public register of government websites to study domain names held by the Dutch national government.

• Lists compiled in-house Finally, we compiled several lists of organisations in sectors of particular significance to society, such as banking and education.

Our methodology has the limitation that all of an organisation's domain names are treated as equally important. We didn't seek to establish whether, for example, a domain name is linked to a login portal whose non-availability would have a direct effect on website visitors and business processes. Individual organisations are better able to assess the importance of domain names than we are, although we could in principle use heuristic indicators, such as the presence or absence of a login window. Such possibilities could be explored in the context of future research.

Result 1: many .nl domain name operators do take steps to increase availability, but there is room for improvement.

Figure 1 shows how many .nl domain names in each of the 6 CrUX buckets use 1 or more of our 3 focus measures to maximise the availability of their DNS servers. We added all the .nl domain names that do not feature in the CrUX list to the lowest popularity bucket (Top 500,000+).

Figure 1: Number of focus measures used to boost the resilience of .nl domain names' DNS servers, broken down by popularity bucket.

As the figure shows, the most popular websites with .nl domain names use more resilience-boosting measures than the less popular ones. For example, more than 70 per cent of the top 1,000 domain names employ 2 or more of the measures, and the percentage is lower in each of the popularity buckets below.

There is a notable deviation from that pattern, however: domain names that aren't in the CrUX list at all score relatively well. Although that may initially sound paradoxical, it can be explained by the fact that a high proportion of low-traffic domain names make use of a small number of DNS service providers that typically do use anycast (figure 2).

Figure 2: Measures taken, broken down by popularity bucket (IPv4).

Figure 2 shows that popular domain names are less likely to use multiple DNS service providers (Measure A). Fewer than 30 per cent of the Top 1,000 domain names use Measure A. However, the service providers in question are relatively likely to use anycast (Measure C) to increase the resilience of their DNS servers. On the other hand, a high proportion of less popular domain names have DNS servers in 2 or more ASes. That is to a significant extent attributable to DNS servers within ASes operated by the same service provider. The good news is that a large proportion of .nl domain names have their DNS servers distributed across multiple IP prefixes, almost regardless of their popularity bucket (Measure B).

Result 2: resilience of the biggest Dutch companies

Although not all large Dutch companies have websites that feature on the CrUX list, the non-availability of their domain names could seriously affect business processes, such as e-mail communication.

Figure 3 shows the measures that the 500 largest companies are using to improve the resilience of their domain names. Statistics on the steps taken to maximise DNS server availability via IPv6 are presented in the appendix.

Figure 3: Measures used to boost the resilience of the domain names of the 500 largest companies in the Netherlands (IPv4).

What stands out from the data is that less than 50 per cent of the domain names in this group have more than 1 measure in place to maximise the availability of their DNS servers. That's a significantly lower proportion than seen with the most popular domain names in the CrUX list. A possible explanation is that many of the popular domain names in the CrUX list point to online services such as webshops. A company providing such a service probably has a stronger incentive to ensure constant availability than, say, a horticultural company that features in the Elsevier Top 500, whose website is 'merely' a shop window.

Result 3: resilience varies from sector to sector

We also investigated the resilience of domain names within certain sectors that have particular societal significance. Figures 4 and 5 show the status of the domain names of hospitals and (central) government entities, for example. Similar statistics on other sectors (banking, education and transport) are presented in the appendix.

Figure 4: Measures taken to boost the resilience of hospitals' domain names (IPv4).

Figure 4 shows that only just over 40 per cent of hospitals' domain names have DNS servers protected by 2 or more of our focus measures. None of their DNS servers are making use of anycast.

By contrast, more than 70 per cent of (central) government domain names have DNS servers protected by 2 or more measures (figure 5). One standout observation is the high proportion of such domain names whose DNS servers are distributed across 2 or more ASes.

Figure 5: Measures taken to boost the resilience of government domain names (IPv4).

Overall picture: a mixed bag

In the initial study described here, we assessed the resilience of the Netherlands' digital infrastructure using measured empirical data. Organisations in the Netherlands do appear to be taking action to boost the resilience of their DNS servers. However, it's apparent that more could be done for many domain names, such as those used in the hospital sector. Although our study examined only one aspect of the Netherlands' digital infrastructure (DNS services), we hope that it will ultimately help to increase resilience.

Test your resilience!

Want to know how resilient your organisation's (DNS) infrastructure is? Download our command-line tool. It currently requires a reasonable amount of technical know-how, so you may need the support of your IT department to use it.

Finally, we'd love to hear what you think of this initiative. If there's sufficient interest, we would consider refining our test tool to make it easier to use.