Re: [DNSOP] Fw: New Version Notification for draft-bellis-dns-recursive-discovery-00

In message <82ljj61gle.fsf@mid.bfk.de>, Florian Weimer writes:
> * Alex Bligh:
> 
> > Could you amplify a bit on this one? I think what you are saying is
> > that recursive servers which do not support DOMAIN.LOCAL.ARPA
> > (and hence don't strip it out of any response to a recursive
> > query) can be subject to poisoning attacks which will result in
> > duff nameserver records being sent to clients that are aware
> > of the protocol.
> 
> I was alluding to this:
> 
> ; <<>> DiG 9.5.1-P3 <<>> @208.67.222.222 DOMAIN.LOCAL.ARPA
> ; (1 server found)
> ;; global options:  printcmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44816
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
> 
> ;; QUESTION SECTION:
> ;DOMAIN.LOCAL.ARPA.             IN      A
> 
> ;; ANSWER SECTION:
> DOMAIN.LOCAL.ARPA.      0       IN      A       67.215.65.132
> 
> ;; Query time: 41 msec
> ;; SERVER: 208.67.222.222#53(208.67.222.222)
> ;; WHEN: Tue Oct 20 13:12:32 2009
> ;; MSG SIZE  rcvd: 51
> 
> And 67.215.65.132 does not offer DNS service.
> 
> > I think that is indeed a security concern, and perhaps not
> > one that can be brushed aside with the response "but such
> > servers can have any DNS query made to them poisoned anyway".
> 
> ARPA will soon be signed, so I don't think this is much to worry
> about.  If the powers that be finally agree to make NXDOMAIN/NODATA
> synthesis the default in the upcoming minor DNSSEC revision, this will
> also help to cut down the number of requests.

And LOCAL.ARPA would need to be a unsigned delegation.

> -- =
> 
> Florian Weimer                <fweimer@bfk.de>
> BFK edv-consulting GmbH       http://www.bfk.de/
> Kriegsstra=DFe 100              tel: +49-721-96201-1
> D-76133 Karlsruhe             fax: +49-721-96201-99
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org