DNSFS: The Creepiest Cloud Storage Hack You'll Ever See

Let's start with a thought experiment. Imagine storing your files not on AWS S3, not on a fancy distributed database, but inside the DNS caches of millions of servers across the internet. Your data would be literally floating around the globe, fragmented across devices you don't own, in resolvers you probably didn't even know existed.

Sounds like something out of a cyberpunk novel, right? Well, someone actually built it.

The DNS Cache Discovery That Started It All

Before we get into the wild stuff, let's talk about something most developers take for granted: DNS TTLs. When you query a domain name, the resolver caches that result for a specified time before checking back. Most of us assume this is a few minutes or hours at most.

But here's the kicker: some resolvers will happily cache entries for an entire week if you ask them nicely.

This discovery led to a fascinating question: if DNS caches can hold data for that long, could we deliberately store files inside them? Not just domain lookups, but actual data?

The answer, surprisingly, is yes.

Meet DNSFS: File Storage Hidden in Plain Sight

DNSFS takes inspiration from an earlier hack called PingFS, which stored data inside the payload sections of ICMP ping packets. The problem with PingFS? You had to constantly ping-pong packets back and forth to keep the data alive. If you stopped transmitting, your data vanished.

DNSFS improves on this concept dramatically. Since DNS resolvers cache responses, once you store a piece of data in a resolver's cache, it persists without you needing to repeatedly request it. The resolver does the work for you.

Think about that for a second. You're essentially using other people's infrastructure—without their knowledge—as a distributed, redundant file storage system.

How It Actually Works

The technical implementation is equal parts clever and concerning.

To make this work, you need open DNS resolvers—servers that will answer queries for any domain, not just ones they're authoritative for. Technically, these should be firewalled off from the public internet because they're a DDoS reflection risk. But here's the thing: millions of devices ship with misconfigured DNS services that are reachable from anywhere.

The system works by breaking files into tiny chunks, encoding them as DNS queries, and distributing those queries across the internet. Each resolver that receives and caches a query now holds a piece of your file. To retrieve the data, you simply query the same resolvers and reconstruct the chunks.

The beauty (and horror) of this system is that the data persists in the cache until the TTL expires—no continuous connection required.

Scanning the Internet for Open Resolvers

Here's where things get both impressive and slightly unsettling.

Building DNSFS requires finding open resolvers across the internet. This means scanning billions of IP addresses to identify which ones will answer DNS queries for arbitrary domains.

One developer used masscan combined with clever BPF (Berkeley Packet Filter) rules to efficiently identify only the resolvers that would be useful—filtering out authoritative-only servers and other noise. The result? Nearly 4 million open DNS resolvers scattered across the globe.

The geographic distribution is eye-opening. China leads with over 1.4 million open resolvers, followed by the United States, South Korea, Russia, and Brazil. But here's the more interesting metric: when you normalize for internet users, small nations like Saint Kitts and Nevis have remarkably high resolver density—roughly one resolver for every 51 people.

Why This Matters (Beyond the Cool Factor)

Let's be clear: DNSFS is absolutely not a production storage solution. It's slow, unreliable, completely unaudited, and arguably a security nightmare. Running a full internet scan for open resolvers also raises serious ethical questions about consent and network boundaries.

But that's not the point.

DNSFS represents the kind of creative, boundary-pushing thinking that advances our understanding of networked systems. It highlights how much misconfigured infrastructure exists on the internet, prompting important conversations about security hardening. It demonstrates the surprising persistence of cached data in distributed systems. And it shows how seemingly rigid protocols can be repurposed in unexpected ways.

It's also a reminder that the internet is far messier than we often assume. Those millions of open resolvers? They're running on home routers, IoT devices, enterprise equipment, and everything in between. Most administrators have no idea their DNS services are accessible from the outside.

The Takeaway for Developers

DNSFS won't be storing your application data anytime soon, but it offers valuable lessons:

Protocols are just starting points. DNS was designed for name resolution. That doesn't mean it's limited to that use case.

Security assumptions matter. Open resolvers exist because someone misconfigured something. Always audit your infrastructure's exposure.

Creative constraints breed innovation. The best hacks often come from working within unexpected limitations. DNSFS exists because someone asked "what if we used the cache?"

The internet is stranger and more malleable than most of us realize. Sometimes the most interesting systems are the ones that probably shouldn't work at all.

Have you encountered any unusual protocol exploits or creative infrastructure hacks? The NameOcean team loves hearing about the inventive ways developers push technology to its limits.