Take a look at http://whatsmyresolver.stdlib.net/ for one simple way.

Full-disclosure: I work on Amazon Route 53, and although we don't quite use that same method - it will give you an idea of what's possible. PS; we're hiring.

How does it work?

1) I visit the site, it gets my IP address

2) Magic happens

3) It displays my nameserver address.

What is going on in step 2?

Edit: worked it out.

For those interested, it uses a Javascript include from a unique subdomain name. Because the subdomain is unique the app can work out the relationship between client IP and resolver.

The html page at http://whatsmyresolver.stdlib.net/ loads a javascript script from the url http://whatsmyresolver.stdlib.net/resolver/.

Fetching http://whatsmyresolver.stdlib.net/resolver/ triggers a 302 redirect to a url of the form;

  http://$guid.nonce.stdlib.net/resolver/

The DNS server authoritative for nonce.stdlib.net has a simple wildcard configured, so *.nonce.stdlib.net all resolve to the same web-server. Obviously the DNS request for the globally unique id domain name has to come before any HTTP request to the guid url, so when the DNS request comes in the authoritative server can record it in a simple lookup store (guid -> resolver source ip).

Then, when the HTTP request makes it to the web-server, it can inspect the Host: header to determine what the guid was. It then uses this guid to correlate the HTTP request it is handling and the resolver source ip, and generates some javascript with the data we need;

  var resolver="192.0.2.53";var edns=true;

It's just a hack I wrote up for my own reasons years ago. But if you'd like to avail of it for any reason (ie helping end-users debug things), feel free to embed;

  <script language="javascript" src="http://whatsmyresolver.stdlib.net/resolver/"/>

and use the variables it populates. No warrantees or guarantee implied :-)

We use a similar method at Facebook.

http://www.facebook.com/note.php?note_id=10150212498738920

If I had to guess, I'd say that since route 53 is a dns host for many domains, they might be able to work out the user ip / resolvers map passively. Pretty awesome stuff, Amazon! This is a big deal for your customers.