[DNSOP] Re: A question regarding DNSSEC validation

[Ben Schwartz <[e-mail]>]

On Wed, Apr 22, 2026 at 12:52 AM Mukund Sivaraman <[e-mail]> wrote:

> Hello Ben
>
> On Tue, Apr 21, 2026 at 04:41:28PM -0400, Ben Schwartz wrote:
> > > We can expect that a DoS on DNSSEC will be much more
> > > rare than attacks on unsigned zones.
> > >
> >
> > I disagree.  "Man on the side" attacks on DNS, by injecting a forged
> reply
> > that races the true reply, are common, and are not limited to unsigned
> > domains.
>
> Are you claiming unsuccessful attacks are common, or successful attacks
> are common?
>

Successful attacks (against non-validating resolvers or unsigned domains)
are common in certain countries [1] and occasionally end up applying
elsewhere [2].

[1] https://www.usenix.org/system/files/sec21-hoang.pdf
[2]
https://securityaffairs.com/86808/security/china-telecom-traffic-hijacking.html

Do you have any statistics or empirical data on successful off-path
> attacks being commonplace against a non-NAT'd resolver that does UDP
> source port randomization, uses an actual random message ID, and
> disables outgoing ICMP error messages (preventing SAD DNS attacks)?
>

I am discussing an "on-path" attacker who is "on the side" in the sense
that they do not (or cannot) drop packets, only add more packets.  The
forged response races the real response (and wins), leading to cache
poisoning (if no DNSSEC) or Bogus status and a SERVFAIL response.

A "DNSSEC Hold On" policy (keeping the UDP listener open until timeout if
the initial response was Bogus) would mitigate this attack behavior,
forcing the injection-only attacker to become a blocking attacker (which is
substantially more expensive to deploy and maintain).

--Ben