Re: [DNSOP] ALT-TLD and (insecure) delgations.

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Ted Lemon writes:
>
> On Feb 7, 2017, at 4:48 PM, Mark Andrews <[e-mail]> wrote:
> > Go add a empty zone (SOA and NS records only) for alt to your
> > recursive server.  This is what needs to be done to prevent
> > privacy leaks.
>
> No, the recursive server can just cache the proof of nonexistence.   I
> didn't query the root when I did my test—I ran the query through
> comcast's servers.   Worked just fine.   Yes, if you configure your local
> server to lie, that won't work.   That's by design.

And how does the server get the proof of non-existence?  It needs
to leak a query.  You server asked comcasts servers.  They in turn
asked the root servers.  By doing so you leaked the query to both
comcast and the root.

Unless you have aggressive negative caching or qname minimisation
you will leak all the leaked *.alt names.  Are you requiring that
every recursive nameserver on the planet older than a couple of
months be upgraded rather than reconfigured to get privacy?

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]