White listing DNS top-talkers

A system for creating a list of trustworthy DNS resolvers comprising:

• a processing system comprising one or more processors;
• a communications port for receiving communications from networked devices and for transmitting communications to the networked devices;
• and
• a memory storing instructions that, when executed by the processing system, cause the processing system to perform operations comprising:
• building, at a computer, a resolver profile for a resolver that is operable to send queries to a domain name server, wherein the resolver profile is based on one or more of a top-talker status of the resolver, a normalcy of distribution of domain names queried, or a continuity of distribution of query type, a RD (Recursion Desired bit status, and information related to query traffic at one or more nodes in a distributed domain name server topology;
• determining that the resolver is trustworthy by applying a policy to the resolver profile;
• and
• adding, by the computer, the resolver to a list of trustworthy resolvers based on the determining that the resolver is trustworthy.

A non-transitory computer-readable medium containing instructions embodied thereon, wherein the instructions, when executed by a processor, cause the processor to perform operations comprising:

• building, at a computer, a resolver profile for a resolver that is operable to send queries to a domain name server, wherein the resolver profile is based on one or more of a top-talker status of the resolver, a normalcy of distribution of domain names queried, a continuity of distribution of query type, a RD (Recursion Desired) bit status, and information related to query traffic at one or more nodes in a distributed domain name server topology;
• determining that the resolver is trustworthy by applying a policy to the resolver profile;
• and
• adding, by the computer, the resolver to a list of trustworthy resolvers based on the determining that the resolver is trustworthy.