  DNS is important in nearly all interactions on the Internet. All large DNS
operators use IP anycast, announcing servers in BGP from multiple physical
locations to reduce client latency and provide capacity. However, DNS is easy
to spoof: third parties intercept and respond to queries for benign or
malicious purposes. Spoofing is of particular risk for services using anycast,
since service is already announced from multiple origins. In this paper, we
describe methods to identify DNS spoofing, infer the mechanism being used, and
identify organizations that spoof from historical data. Our methods detect
overt spoofing and some covertly-delayed answers, although a very diligent
adversarial spoofer can hide. We use these methods to study more than six years
of data about root DNS servers from thousands of vantage points. We show that
spoofing today is rare, occurring only in about 1.7% of observations. However,
the rate of DNS spoofing has more than doubled in less than seven years, and it
occurs globally. Finally, we use data from B-Root DNS to validate our methods
for spoof detection, showing a true positive rate over 0.96. B-Root confirms
that spoofing occurs with both DNS injection and proxies, but proxies account
for nearly all spoofing we see.
