7. The computer-implemented method of claim 1 , wherein: determining comprises applying the policy comprising one or more arrays including one element for each profile feature; the elements are binary values indicating either a normal or abnormal profile feature; and adding the resolver comprises adding the resolver to the list of trustworthy resolvers if its profile matches one of the preset policy arrays.
1. A computer-implemented method for creating a list of trustworthy DNS resolvers, the method comprising: building, at a computer, a resolver profile for a resolver that is operable to send queries to a domain name server, wherein the resolver profile is based on one or more of a top-talker status of the resolver, a normalcy of distribution of domain names queried, a continuity of distribution of query type, a RD (Recursion Desired) bit status, and information related to query traffic at one or more nodes in a distributed domain name server topology; determining that the resolver is trustworthy by applying a policy to the resolver profile; and adding, by the computer, the resolver to a list of trustworthy resolvers based on the determining that the resolver is trustworthy.