Starlink in the Wild: Multi-Perspective Measurements via DNS

Starlink, the low-Earth orbit (LEO) satellite constellation developed by SpaceX, has rapidly become the world's largest commercial satellite network and a key component of the global Internet infrastructure. Despite its growing prominence, critical aspects of its terrestrial operations, including its internal network architecture, user behavior patterns, and potentially vulnerable exposed services, remain largely unexamined. This paper presents a multi-perspective measurement that characterizes Starlink's ground-side infrastructure and ecosystem from a DNS-centric viewpoint. First, we leverage internal DNS leakage to infer the structure of Starlink's private networks. Second, we analyze passive DNS data to identify user behavior patterns and service usage trends. Finally, we perform large-scale active scanning of Starlink's IP address space to evaluate its service deployment and security posture, utilizing DNS records to isolate infrastructure-related IPs from those of end-users. Collectively, our findings provide novel insights into the architecture, operation, and security of Starlink's terrestrial network.