15. A non-transitory computer-readable medium containing instructions embodied thereon, wherein the instructions, when executed by a processor, cause the processor to perform operations comprising: building, at a computer, a resolver profile for a resolver that is operable to send queries to a domain name server, wherein the resolver profile is based on one or more of a top-talker status of the resolver, a normalcy of distribution of domain names queried, a continuity of distribution of query type, a RD (Recursion Desired) bit status, and information related to query traffic at one or more nodes in a distributed domain name server topology; determining that the resolver is trustworthy by applying a policy to the resolver profile; and adding, by the computer, the resolver to a list of trustworthy resolvers based on the determining that the resolver is trustworthy.
15. A non-transitory computer-readable medium containing instructions embodied thereon, wherein the instructions, when executed by a processor, cause the processor to perform operations comprising: building, at a computer, a resolver profile for a resolver that is operable to send queries to a domain name server, wherein the resolver profile is based on one or more of a top-talker status of the resolver, a normalcy of distribution of domain names queried, a continuity of distribution of query type, a RD (Recursion Desired) bit status, and information related to query traffic at one or more nodes in a distributed domain name server topology; determining that the resolver is trustworthy by applying a policy to the resolver profile; and adding, by the computer, the resolver to a list of trustworthy resolvers based on the determining that the resolver is trustworthy. 20. The non-transitory computer-readable medium of claim 15 , wherein: the resolver profile comprises an array including one element for each profile feature; and the elements comprise binary values indicating that profile features are either normal or abnormal.