@inproceedings{SommersEtAl:IMC26,
  author	= {Sommers, Joel and Kranig, Calvin and Wung, Wei-Shiang and Barford, Paul and Crovella, Mark and Pauley, Eric},
  title		= {{namefill: Synthesizing DNS Naming Conventions}},
  booktitle	= {Proceedings of the Internet Measurement Conference},
  year		= {2026},
  URL		= TBD,
  doi		= TBD
  abstract	= {DNS naming conventions reveal information about infrastructure deployments, operational configurations, and network topology. In this paper, we present namefill, a tool that uses programming by example to synthesize executable functions that summarize DNS naming conventions. Unlike regular expressions, which match but cannot generate, a synthesized namefill function produces the predicted fully-qualified domain name (FQDN) for addresses within the prefix it was synthesized from, enabling active probing for as-yet undiscovered FQDNs and systematic auditing of existing records. Applied to 1.2 billion PTR records, namefill synthesizes 313K distinct naming conventions across 254K registered domains. Using a PTR record dataset from CAIDA's ITDK, we find that namefill covers 69.7\% of IPv4 FQDNs and that its coverage is largely complementary to other tools that focus on names that embed geotokens. We use the synthesized naming conventions to systematically identify naming anomalies, including incorrect prefix bytes in PTR record names and inconsistencies in separator characters between IP address bytes. We identify 991 misconfigurations covering 236K PTR records and 1,639 inconsistencies covering 426K PTR records from 2026, and verify 43 misconfigurations with network operators. Lastly, we use the synthesized functions as a DNS record discovery tool to enumerate names in the DNS previously not captured in our source data. From 2.76M training names we find 194M previously unrecorded forward DNS names using 355M queries; a 70x increase.}
}