As　the　hidden　backbone　of　today＇s　Internet,　the　Domain　Name　System　(DNS)　provides　name　resolution　service　for　almost　every　networked　application.　To　exploit　the　rich　DNS　query　information　for　traffic　engineering　or　user　behavior　analysis,　both　passive　capturing　and　active　probing　techniques　have　been　proposed　in　recent　years.　Despite　its　full　visibility　of　DNS　behaviors,　the　passive　capturing　technique　suffers　from　prohibitive　management　cost　and　results　in　tremendous　privacy　concerns　towards　its　largescale　and　collaborative　deployment.　Comparatively,　the　active　probing　technique　overcomes　these　limitations,　providing　broad-view　and　privacy-preserving　DNS　query　analysis　at　the　cost　of　constrained　visibility　of　fine-grained　DNS　behavior.　This　paper　aims　to　accurately　estimate　DNS　query　characteristics　based　on　DNS　cache　activities,　which　can　be　acquired　via　active　probing　on　a　large　scale　at　negligible　management　cost　and　minimized　privacy　concerns.　Specifically,　we　have　made　three　contributions:　(1)　we　propose　a　novel　solution,　which　integrates　the　renewal　theory-based　DNS　caching　formulation　and　the　hyper-exponential　distribution　model.　The　solution　offers　great　flexibility　to　model　various　domains;　(2)　we　perform　a　large-scale　real-world　DNS　trace　measurement,　and　demonstrate　that　our　solution　significantly　improves　the　estimation　accuracy;　(3)　we　apply　our　solution　to　estimate　the　malware-infected　host　population　in　remote　management　networks.　The　experimental　results　have　demonstrated　that　our　solution　can　achieve　high　estimation　accuracy　and　outperforms　the　existing　method.　(C)　2014　Elsevier　Ltd.　All　rights　reserved.