Re: [Doh] Mozilla's plans re: DoH

[Brian Dickson <[e-mail]>]

On Fri, Mar 29, 2019 at 11:31 AM Livingood, Jason <
[e-mail]> wrote:

> > [2] Many networks redirect NXDOMAIN to a search/advertising page.
>
> [JL] This is a reply on this somewhat minor point because NXDOMAIN was
> also raised at the side meeting. I wonder if folks have more specific
> references to networks that are *currently* engaged in NXDOMAIN
> redirection. My sense is that this practice was largely fallen by the
> wayside as a result of being overtaken by the browser-based omnibox
> function that launched several years ago and the resulting change in user
> behavior to just type search terms into the address bar and then click on
> search results. In any case, curious to know if there's a list of ISPs
> currently doing this.
>
>
It is probably worth pointing out that, with a very few exceptions in the
CCtld space, that TLDs are DNSSEC signed, and DNSSEC validation can help
prevent NXDOMAIN redirection.
There is still a problematic issue with NSEC3 opt-out. With NSEC or NSEC3
with no opt-out, it is possible to distinguish unsigned delegations from
NXDOMAIN results. When opt-out NSEC3 is used, that is not possible.

This means that in NSEC3 opt-out TLDs, it is technically possible for
NXDOMAIN rewriting by re-purposing the DNSSEC "proof" of NXDOMAIN, into a
DNSSEC "proof" of unsigned delegation.

For TLDs that don't do opt-out, NXDOMAIN rewriting can be blocked by doing
DNSSEC validation.
(This would seem to suggest that having TLDs move away from opt-out would
be in everyone else's interest.)

Brian