Blog proposal: measure DNS cache isolation between synthetic clients

[williamzujkowski]

Reader question

Which shared DNS cache lets one client infer another client's synthetic activity, and where does cache separation stop helping?

Evidence and angle

DNS FLaRE: A Flush-Reload Attack on DNS Forwarders, Moav et al., is a peer-reviewed USENIX Security 2025 paper (August 2025, pp. 3557–3576). The proceedings PDF, especially §§8.8–8.9, distinguishes encrypted transport from cache behavior. RFC 9076 supplies cache-snooping context.

The DoH deployment post covers transport setup; the VLAN post covers network boundaries. This proposal measures shared cache state across those boundaries.

Proposed experiment — not yet run

Two synthetic clients query owned .test names answered entirely inside a disposable VM. Compare a shared forwarder; separate forwarders with a common upstream cache; separate forwarders and upstream caches. Record pinned resolver versions, topology, TTL, cache-hit evidence, query counts, and latency distributions.

Randomize activity/inactivity labels; separate calibration and held-out runs. Compare held-out AUC and false-positive rate with a label-permutation baseline. Falsifier: timing fails to distinguish the states beyond that baseline. A remaining signal after forwarder separation must be checked against the common upstream before claiming isolation works or fails.

Planning cap: one day, 4 CPU cores/8-GB RAM, at most 10,000 queries total at 20 queries/second across the lab. No public resolvers, real browsing histories, live websites, household users, or public listeners. Use synthetic direct-client measurements: this is inspired by the paper, not a reproduction of its browser exploit. Browser mitigations and timing noise constrain transfer to real environments; DoH and VLANs are not universal cache-isolation guarantees.

Acceptance

• Publish raw measurements, pinned configuration, seeds, controls, and negative results.
• Diagram which caches are shared in each topology.
• Separate protocol facts, paper findings, local measurements, and untested implications.
• Complete accuracy, security/privacy, overlap, voice, artifact, and visual reviews.

[williamzujkowski]

Backlog grooming (2026-09-12): candidate research proposal. Keep distinct from the existing DoH deployment post and coordinate with #593.

[williamzujkowski]

Proposal review — 2026-09-13

Review decision: priority 4 — defer, retain the narrower topology experiment. This is DNS cache state, not the Linux page-cache experiment scheduled for September 21. It is not completed by #599/#603, though the shared-state theme warrants editorial spacing. The DoH repairs #593/#620 are already complete.

The worthwhile delta is comparing shared forwarders, separate forwarders with a common upstream cache, and separated upstream caches. Verify cold/warm state and pair direct cache-hit evidence with held-out discrimination and permutation controls. Keep the one-day feasibility cap; preserve failed controls/negative results without retuning until positive.

DNS FLaRE's browser attack is not reproduced by this direct-client toy. Its discussion also notes that broadly shared resolvers dilute individual attribution. Do not generalize two synthetic clients into a universal public-resolver tracking claim. If only the generic privacy warning survives, consolidate it with existing coverage.

Full evidence and ranked portfolio: https://github.com/williamzujkowski/williamzujkowski.github.io/blob/main/docs/research/2026-09-13-proposal-review.md

This records editorial priority and evidence gates, not completed experiments or publication approval. Existing scheduled posts are unchanged.