New Zealand's COVID-19 lockdown: a view from the DNS

At InternetNZ, we guard the .nz namespace for all New Zealanders. As part of our role, we take care of managing the register for .nz domains, and also operate critical infrastructure that allow those domains to work: the DNS.

If the idea of DNS is alien to you, it’s an essential component for the Internet you use everyday that takes care of converting names you can remember (internetnz.nz) into addresses computers understand. Our infrastructure sees over 4 billion queries per week, and yes, it’s in the order of billions, not millions!

As New Zealand and the world goes through the CoVid-19 pandemic, lockdown periods and changes to human behaviour, we wanted to take a look, from the DNS perspective, what changes we can observe.

From New Zealand with love

Out of the 4 billion queries generated in a week for .nz, around 200 million come from inside New Zealand. We’re taking a closer look at the activity that originated from NZ to explain what’s happening.

Our window of exploration goes back to 9 of March 2020, by that time New Zealand already recorded their first CoVid-19 case but no drastic measures were taken. On March 21st, the Level system was announced, where Level 4 is full country lockdown- meaning all non-essential travel needs to stop and people must start working from home if possible.

We consider the weeks starting March 9 and March 16 to be normal, but March 23rd onwards part of the lockdown period. From Figure 1 you can see how DNS activity has increased steadily since the lockdown, with variations between 5 to 7%. Last week saw a drastic dip due to April 13th being a holiday.

The DNS activity we see should be considered a proxy of what’s going on within the Internet in New Zealand, as the relation to human activity is not directly one DNS query-one action, because most of the DNS traffic is efficiently cached by ISPs. The data we have available is very rich and details up to the minute can be observed. Below, we dig more into how the activity changed by the hour of the day and the day of the week across different weeks. 

We’ve already observed activity across the weeks ramping up, but here we can tell how different days compare. It’s not surprising weekdays are busier than weekends, and progressively weekdays during the lockdown get busier and busier. For most of the weekdays, we can see a double peak, one between 10 and 11 in the morning and a second peak around 2 pm, likely people picking up activity after lunch break.

On any day, we can see activity for almost 90% of all domains in the register, meaning we can see activity for over 600,000 different domains. However, not all domains are created equal, and some of them get way more traffic than others. For example, the most popular .nz domain is not related to news, retail, or government but instead corresponds to the file-sharing platform mega.nz.

We also explored the traffic by type of domain, gathering some well-recognised domains and their main activity. This list doesn’t intend to be exhaustive.

• Banks: asb.co.nz, bnz.co.nz, westpac.co.nz, kiwibank.co.nz, anz.co.nz
• Government: covid19.govt.nz, mbie.govt.nz, police.govt.nz, treasury.govt.nz, ird.govt.nz, health.govt.nz, msd.govt.nz, studylink.govt.nz
• Retail: thewarehouse.co.nz, briscoes.co.nz, kmart.co.nz
• Streaming: netflix.co.nz, tvnz.co.nz, neontv.co.nz, sparksport.co.nz, lightbox.co.nz
• Supermarket: countdown.co.nz, newworld.co.nz, paknsave.co.nz
• Travel: houseoftravel.co.nz, flightcentre.co.nz, expedia.co.nz, safetravel.govt.nz, statravel.co.nz, helloworld.co.nz, airnz.co.nz

Using the week of 9 March as baseline for the comparison, we can see how much activity of the following weeks each category got. The results are below.

You can see, by April, our selected list of domains representing Government services saw an increase of more than 40% activity. Also, supermarkets at the beginning of the lockdown period saw great growth as more people looked into doing online shopping instead of visiting the store due to the restrictions in access. As you can expect, Streaming platforms also saw an increase, and we are not counting Netflix here as they use their .com domain. Unfortunately, domains related to Travel lost nearly 40% of their activity due to the travel restrictions still in the country. We are sure they will bounce back once we get back to normal.

There is one particular domain name we would like to really focus on: covid19.govt.nz. This domain was created by the NZ government to collect all the relevant information related to CoVid19, as a centrepiece to their communication campaign. It was added to the register around March 16 and started to see considerable activity around March 18. Within New Zealand, most days there is a press conference to report new cases, deaths and any changes to the CoVid-19 situation in the country. Curiously enough, the peaks of activity for this domain are well aligned with those press conferences.

COVID-19 and domain registrations

We have seen across the world the pandemic has been fertile ground for domain abuse; people registering domain names for speculation and misinformation. We took a look at the registrations in the past two months and used some keyword matching and similarity matching for terms related to the pandemic, such as “c19”, “covid19”, “coronavirus”, “mask”, “clean” and “lockdown”. Compared to other registries, we don’t get that much attention but it is something to watch.

As of April 28th, New Zealand moved from a Level 4 lockdown to Level3, allowing online stores to sell goods online and pick-up if contactless. We imagine that could explain why we are seeing a lot of new registrations in the past week focused on online shops with keywords such as “online”, “kiwi” and “shop”.

This has been a challenging and rewarding piece of work, where we dive deep into DNS data to understand how reflects what's happening in our country. Definitely there is more analysis to come, as we take a look at domain name registrations increases as we haven't seen in a long time. Stay tuned!