Subject: [dns-dir] DNS-EW: draft-hoffman-dns-last-hop-00.txt

From: DNS_EARLY_WARNING <[email-masked]>
Date: Mon, 6 Dec 2010 14:40:01 -0500

Count:       87 

Network Working Group                                         P. Hoffman
Internet-Draft                                            VPN Consortium
Intended status: Standards Track                        December 5, 2010
Expires: June 8, 2011

                  Wrapping DNS for Traffic Protection
                     draft-hoffman-dns-last-hop-00

 Abstract

   DNS queries from one resolver to an upstream resolver are often run
   over connections with no protection of any kind.  This connection, is
   currently susceptible to both malicious and unintentional alteration
   that prevents the querying resolver from being sure that the results
   it receives are valid.  Some middleboxes can prevent a querying
   resolver that does DNSSEC validation from getting enough information
   to validate a response.  Further, a non-validating, non-iterative
   resolver querying a trusted recursive resolver is susceptible to
   active attacks in which the results are purposely altered.

   The protocols described in this document provide two methods to avoid
   these problems and thus make resolution significantly more secure.
   These protocols can be used between any two DNS resolvers, but they
   are particularly useful for queries from "last-hop" stub resolvers to
   trusted recursive resolvers.