Re: Autonomous System Sanity Protocol

[[e-mail]]

On Sat, 26 Apr 1997 20:05:44 PDT, Bill Manning said:
> Humm, perhaps a first, rough cut might be turning on DNS Security for the
> inverse delegations all the way down.  That way you could get a "chain of
> custody" for the authoritative delegations.  You could also discriminate
> proxy aggregations... :)

Hmm.. but  first, we have  to  actually get  inverse delegations  that
work.

Hell. In the past 5 days  on our Listserv hub,  I've seen no less than
661 *different* 'Lame  server'  messages from BIND for  the  *forward*
lookup.

On the other hand, Bill  may be onto  something  here.. if we  require
that the  people get their  acts together  enough  so their nameserver
forward and  inverse tables are correct, and  get crypto keys  set up,
that would probably  nuke out all  the marginal domains  that have too
low a cluon flux  density.  It  wouldn't stop  a determined  and clued
attacker, but at least we'd probably turn off most possible origins of
"network meltdown  from    'ISP  Administration for   Dummies'"   type
attacks....


-- 
				Valdis Kletnieks
				Computer Systems Engineer
				Virginia Tech