8. A system for creating a list of trustworthy DNS resolvers comprising: a processing system comprising one or more processors; a communications port for receiving communications from networked devices and for transmitting communications to the networked devices; and a memory storing instructions that, when executed by the processing system, cause the processing system to perform operations comprising: building, at a computer, a resolver profile for a resolver that is operable to send queries to a domain name server, wherein the resolver profile is based on one or more of a top-talker status of the resolver, a normalcy of distribution of domain names queried, or a continuity of distribution of query type, a RD (Recursion Desired bit status, and information related to query traffic at one or more nodes in a distributed domain name server topology; determining that the resolver is trustworthy by applying a policy to the resolver profile; and adding, by the computer, the resolver to a list of trustworthy resolvers based on the determining that the resolver is trustworthy.
11. The system of claim 8 , the operations comprising blocking queries from the resolver if the corresponding resolver profile is not determined to be trustworthy.