Summary

  • RFC 1296's ZONE program discovered domains, checked a contacted server with SOA, requested AXFR, and built a host table from returned records. For the study, a host was a discovered grouping of one or more names and one or more IP addresses, not a test of direct accessibility.
  • The memo records two directions of error. Refused or failed transfers and hosts absent from DNS make the collection too low; malformed, non-authoritative and transition-era residual entries can make it too high. After manual review, the author calls the ZONE result a minimum number of hosts, not the actual figure.

The number in RFC 1296 — Internet Growth (1981-1991) is memorable: 727,000 IP hosts in January 1992. The method that produced it is more important. A public statistic appears to turn a dispersed network into a single object that can be counted. Lottor instead leaves the joints visible. The program observed a particular namespace with a particular collection procedure. It then made a claim only as strong as that procedure could bear.

This was not a casual scrape of names. ZONE — Zealot Of Name Edification — maintained a working list of domains and servers, plus a flag for whether one server had successfully supplied information for a domain. It was primed with top-level domains and their name servers because a BIND problem required that starting set. For an untransferred domain, it contacted a server over TCP, asked an SOA question to establish that the server was authoritative for the requested domain, and only then sent AXFR to request the zone's resource records. An NS record expanded the work list; received A, CNAME, HINFO and MX records fed an in-core table.

A pass that found no new information ended the walk, which wrote a HOSTS.TXT-style file.

That sequence says something precise and limited. An SOA response at that moment established the collector's basis for asking that server about that domain. An AXFR response made records available to the collector. A parsed record could enter the table. None of those events established that a physical machine was reachable from the Internet, that every advertised name described a distinct operating host, that a company belonged under one definition of the Internet, or that every host that mattered appeared in DNS at all.

A transfer was evidence of collection, not a census

The transition from host table to DNS tempted observers to treat a distributed directory as a complete list. RFC 1296 makes clear why that inference failed. Before DNS, selected copies of the SRI-NIC Official Host Table supplied the earlier counts. DNS was introduced around 1984 and took nearly four years to become fully implemented, while many hosts had already ceased to be registered in the old table. ZONE was written in 1986 for the transition: it could walk the DNS tree and build a host table for sites that had not moved. The program was not ultimately used for that transitional service. It became a statistics collector.

Its collection capacity itself had a history. Early BIND implementations had major zone-transfer problems, so ZONE could not collect complete DNS data until around 1988. As the namespace grew, a collection expanded from hours to a week and the resulting table neared 50 megabytes. The memo says that the then-current mode retained only host names and IP addresses, ignoring protocol, host-information and MX data before utilities such as sort, uniq and grep produced the requested statistics. It was run every three months at SRI.

Those operational details are not decorative. They make every headline figure dependent on a time window, a starting list, which servers answered, which transfers completed, which record classes were retained and which grouping rule was later applied. A collection that lasts a week is not a photograph taken at one instant. A quarterly run is not an always-current inventory. A program that ignores a field cannot later offer that field as evidence. Method is part of the number.

The strictest limit came from access to the source data. Some sites did not allow zone transfers. ZONE eventually gave up after too many failures. In the 1 January 1992 run, roughly 800 of 17,000 domains could not be transferred. The memo also assumes that not all Internet hosts were registered in a domain server. Both conditions are missing-observation problems: the collector does not see a record that could have contributed to the count. RFC 1296 therefore says that they make the gathered statistics lower than the actual amounts.

That conclusion is stronger than saying that a tool had occasional errors and weaker than saying that the world was fully measured. It is an asymmetry argument under described conditions. If inaccessible zones and unregistered hosts are omitted, the record-derived total cannot simply be presented as the total population. Calling it a minimum retains the direction of the known omission without pretending to know the size of what was omitted.

Extra records did not repair missing observations

The memo does not hide the opposite problem. Manual review found random material in DNS. Misformatted entries could yield bogus server or host records. A listed server could turn out not to be authoritative for the domain beside it. During a rename, an entire domain's old entries might be left in place for a transition period, allowing each host to be counted twice. These are not missing observations; they are additions or duplications inside the collected data, and they push a count upward.

The key judgment in RFC 1296 is comparative. Manual scanning indicated that the additions were insignificant beside the missing entries already described. On that basis, the document says ZONE data can be viewed as the minimum number of Internet hosts and not the actual figures. The phrase should not be detached from the review. It is not a mathematical proof that all DNS walks always underestimate. It is the author's stated assessment of this program, this material and these error sources.

This matters because an aggregate can conceal two very different tasks. One task is to retain every observation and its provenance: which domain, which server, which attempt, what authority check, which transfer outcome, which records and which time. The other task is to decide whether records represent the study object and whether the residual errors permit a directional conclusion. Sorting and deduplicating can reduce repeated names; it cannot decide whether an absent transfer hid ten hosts, whether a stale name represented one host twice, or whether an advertised host could receive a connection.

The study's definition keeps that boundary visible. A host is a [name(s), IP-address(es)] grouping discovered from DNS. The grouping prevents a single host with several names or addresses from being counted more than once. It does not consider whether the host is directly accessible. When ZONE counts domains, it includes every domain referenced by an NS record, including mail-forwarding-only domains for sites that could be off-Internet, such as Usenet sites. The record rule supplies consistency. It does not settle the meaning of “on the Internet.”

A visible name was not a reachable host

RFC 1296 asks the scope question directly. A host entry in DNS does not necessarily mean that the host is reachable from the Internet. A company may put mail gateways between the Internet and local networks, blocking direct access while advertising all hosts, or advertising only the gateway. The memo asks whether either group should count. It also asks whether an MX-only domain belongs in an Internet-size study. These are not implementation glitches. They are disagreements about the object to be counted.

The distinction is useful beyond its historical setting. A DNS response can support a claim about a record returned by a server. A completed AXFR can support a claim that a collector received a zone's records. A normalizer can support a claim that it applied a grouping rule. None alone supports an availability claim, a policy claim, an identity claim or a population claim. Each stronger sentence introduces an additional definition, observation method or authority source.

The cost discussion reinforces that point. Downloading information from every domain generated substantial network traffic and added CPU load to contacted servers. RFC 1296 suggests that an organized effort might have one such program run on a regular schedule so multiple collectors would not repeat the burden. That is a proposal about collection governance, not evidence that the Internet had one sanctioned census-taker. A collector's technical ability to ask does not by itself grant an unlimited right to impose cost or to declare a definitive public count.

The future design separated freshness from completeness

In its future issues, the memo describes ZONE running in assembler on a DECsystem-20, approaching the limits of its address space and keeping all data in core so it could match nicknames with official names before writing complete records. It proposes disk storage, parallel transfers and a continuing cycle lasting weeks to a month, updating a local statistics database. The proposal shows where the author expected the measurement burden to grow. It does not prove that a new architecture was built, that a continuous database existed, or that a later count became complete.

That restraint is the article's central historical lesson. More frequent collection can reduce the age of an observation. Parallel transfers can reduce elapsed collection time. Persistent storage can make a crash less destructive. None removes the distinction between a record and a reachable host, between an advertised name and a population, or between an observed lower bound and an actual total.

Sources and evidence limits

The sole source is RFC 1296. It supports the memo's January 1992 Informational status; its use of host-table archives and ZONE data; the SOA and AXFR collection sequence; the record types and host grouping; the failed-transfer, absent-host, malformed-record and residual-entry limits; the stated lower-bound conclusion; the scope questions; the recorded January 1992 figures; collection cost; and the future design proposal. It does not prove a current DNS population, a live AXFR result, a modern BIND property, a current enumeration policy, a host's reachability, an organization's membership, a security posture, a deployed replacement collector or any later outcome.