The .nl registry operator has launched a new data publication initiative at rssac002.sidnlabs.nl, making daily DNS traffic statistics available to researchers and operators. The metrics follow RSSAC002, a standard developed by ICANN's Root Server System Advisory Committee, marking the first time a top-level domain has adopted this format for public reporting.

What SIDN is publishing

Each day, the .nl authoritative nameservers process billions of DNS queries globally. SIDN Labs distills this traffic into daily metrics covering query volumes, response counts, response codes and the quantity of unique query sources. The data is available both on the website and via GitHub at github.com/SIDN/nl-rssac002.

Registry operators have shared DNS statistics before. CZ.NIC publishes figures for .cz, the .ie registry includes traffic data in annual reports, and SIDN itself has maintained statistics at stats.sidnlabs.nl since 2015. However, each registry has used different metrics, definitions and formats, preventing meaningful comparison. By adopting RSSAC002, .nl becomes comparable with root server data and potentially with other registries that follow suit.

Why this matters

The DNS functions as the internet's directory system. Before a browser reaches a .nl website, a resolver queries the .nl nameservers for the address. This published data provides visibility into DNS usage at the second level of the hierarchy, offering the same perspective that root servers provide but specifically for one of the world's largest country-code domains.

With identical formatting, traffic patterns from .nl can be directly compared against root server activity. On a typical day, the .nl nameservers collectively handle roughly the same volume as D-Root, one of the 13 root servers, and approximately 50 percent more than B-Root.

The dataset enables several types of analysis:

  • Tracking internet evolution: adoption rates of IPv6 and TCP, response size trends, and fragmentation issues related to DNSSEC
  • Quantifying noise: measuring queries for nonexistent domains, which often indicate misconfiguration or malicious activity
  • Detecting anomalies: identifying sudden traffic spikes or drops that may signal outages, attacks or shifts at major resolver operators

Researchers gain access to DNS measurement data for trend analysis spanning years. Operators can benchmark their own traffic against a major ccTLD and root servers. Existing analysis tools designed for root server data, including RSSAC002 charting utilities, function without modification on .nl datasets.

The open infrastructure approach

SIDN Labs operates on the principle that core internet infrastructure measurement data should remain publicly accessible. The organization has benefited from root server RSSAC002 data in its own research and views this publication as reciprocal contribution to the research community.

The entire pipeline is open source. Data originates from ENTRADA, SIDN's open-source DNS data warehouse. Metric computation uses a tool forked from an original version developed by computer science students at TU Delft during a Software Project course, where undergraduate teams spend three months building production software for external clients. Any ENTRADA user can execute the tool to generate identical statistics for their own nameservers, and SIDN encourages other TLD operators to publish comparable datasets.

Privacy safeguards

The published files contain only aggregated daily statistics. No personally identifiable information is included: no IP addresses, no individual query records and no domain names that were queried.

Future direction

Currently, SIDN publishes data in batches. The next phase involves full automation to release new files continuously each day without manual intervention.

Resources

  • Website: rssac002.sidnlabs.nl
  • Datasets: github.com/SIDN/nl-rssac002
  • Tool: github.com/SIDN/entrada-rssac002 (fork of the original by TU Delft students)