Re: [DNSOP] Wildcard junk vs NXDOMAIN junk
Brian Dickson <brian.peter.dickson@gmail.com> Thu, 07 April 2022 21:26 UTC
Return-Path: <brian.peter.dickson@gmail.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 979563A17B3 for <dnsop@ietfa.amsl.com>; Thu, 7 Apr 2022 14:26:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.107
X-Spam-Level:
X-Spam-Status: No, score=-7.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bRIwk6UovWGZ for <dnsop@ietfa.amsl.com>; Thu, 7 Apr 2022 14:26:14 -0700 (PDT)
Received: from mail-ed1-x52c.google.com (mail-ed1-x52c.google.com [IPv6:2a00:1450:4864:20::52c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A0F23A17A9 for <dnsop@ietf.org>; Thu, 7 Apr 2022 14:26:14 -0700 (PDT)
Received: by mail-ed1-x52c.google.com with SMTP id w18so7870139edi.13 for <dnsop@ietf.org>; Thu, 07 Apr 2022 14:26:14 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=VlFDBlEynVEdgyg5beAuc7br0lXJ3VZcBFZMtgISZII=; b=FfU+01NQV7r/vjQ7tqXVXqIKnq5GPdiKcMseCyw6tjiXj+aCQ6W2Z929oMWEkHBPpm 5pKORGZA/vNRahxuRmAb29cV4mTwmktAX6rKLONcJuTXFYXMctq/J1IHoPOauEVRlTtq cY/qsReYawKVgAxOb60YV2nfFltyXKQHjd2CdKrQeAVrhxZAg27VFcTSr+7n8mY8EqXu cc8VN/ai1Tpos0qvyGTG+6aTs6MfTT8PmbJCQP1XxFCYKgDHnZLe1HS5tb2yFjCVG5qC VqXf5x26AmkD1xzlInl/ehiG3Nx36pD3VjSzqIQd2ppO3FPjS8mYNJ3912ZDpaV01wtk zsGQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=VlFDBlEynVEdgyg5beAuc7br0lXJ3VZcBFZMtgISZII=; b=xkgLBreJqazU+PdpdEhlMNqc0NOlNSwcSr9EIAngOIkJX7pphX34k6EH4TxQKVYg6U oZ2OJerbyjx/XPGt2bvs2nQcto+AqKHxzMfLJue3vljLwqdqE6n/5gT7luGeknUQ5al1 3fAmU4rvC6k8FZqtPRNbmF6JllqB9XG1bTbsrZYTnYTRDy3OUU/okZWfYtvkeSSx6rdw FPU4lVzMPrhggC/NLI2pXdCinHWUaVoWEzwobt6i+6YRGLqc/fjDumXXglB/d1OyMP5K jU9KuEZtuPSXpfBMtDvBHDCjUUCpFGhrNLuFhmTROw2V3iN3ZtkiYGr443ulxpBaYLRi TO4Q==
X-Gm-Message-State: AOAM531xKJg1h2YY4XE5ryelXWkC1RsbKtVD4cw+h3v7VDeIKE1xQmmy 4AUpRIGS0wa9pmugrvIx91Uxrcbld4xOlqFyKQZGzSU1
X-Google-Smtp-Source: ABdhPJxXSCjtjLQmhZjQ5KCZh/U/285MMrRAhP0os8DwXhkPGxUwkvWWdbZw/XQTf0+57JIZQ09njW9q6QKAnlMrPYI=
X-Received: by 2002:a50:baa8:0:b0:415:b0bc:6353 with SMTP id x37-20020a50baa8000000b00415b0bc6353mr16490403ede.220.1649366772371; Thu, 07 Apr 2022 14:26:12 -0700 (PDT)
MIME-Version: 1.0
References: <9355318d-a779-400f-9e3b-27b53fa3e9bf@iecc.com>
In-Reply-To: <9355318d-a779-400f-9e3b-27b53fa3e9bf@iecc.com>
From: Brian Dickson <brian.peter.dickson@gmail.com>
Date: Thu, 07 Apr 2022 14:26:01 -0700
Message-ID: <CAH1iCioHeP93Txqk=fO0z5UdPX5XmDsFs5GzggySTmEAJDRrcg@mail.gmail.com>
To: "John R. Levine" <johnl@iecc.com>
Cc: "dnsop@ietf.org WG" <dnsop@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000092559e05dc172020"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/lt672u3WkQ86qYQA9gCNY5u9j-Y>
Subject: Re: [DNSOP] Wildcard junk vs NXDOMAIN junk
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 07 Apr 2022 21:26:21 -0000
On Thu, Apr 7, 2022 at 9:51 AM John R. Levine <johnl@iecc.com> wrote: > A friend of mine asserts that wildcard DNS records are a problem because > hostile clients can use them to fill up DNS caches with junk answers to > random queries that match a wildcard. But it seems to me that you can do > it just as well with random queries that match nothing and fill up the > cache with NXDOMAIN junk answers. Am I missing something here? > > If you add DNSSEC, with or without RFC 8198 response synthesis, the > details change but I don't think answer does, it's about the same either > way. > Yep, I agree. However, that does provide motivation for (a) signing zones, and (b) resolvers doing validation with synthesis. Together, those reduce (a) load on auth servers, and (b) cache pollution. Win/win. Brian
- [DNSOP] Wildcard junk vs NXDOMAIN junk John R. Levine
- Re: [DNSOP] Wildcard junk vs NXDOMAIN junk Patrik Fältström
- Re: [DNSOP] Wildcard junk vs NXDOMAIN junk Brian Dickson
- Re: [DNSOP] Wildcard junk vs NXDOMAIN junk Paul Vixie
- Re: [DNSOP] Wildcard junk vs NXDOMAIN junk Mark Andrews
- Re: [DNSOP] Wildcard junk vs NXDOMAIN junk Paul Vixie