Subject: Re: Anti DNS spoofing - Extended Query ID (XQID)

From: Florian Weimer <[email-masked]>
Date: Fri, 20 Jun 2008 04:06:22 +0200

* Jesper G. Høy:

>> This is a problem because some servers will return error
>> responses when you query a subdomain of an existing name.  Some will
>> even drop the query.
>
> I haven't tested extensively, but I have not run into that situation so far.
> Do you have any examples of such servers?

Right now, the name servers for www.cnn.com do not answer queries for
1.www.cnn.com.  This seems to be the result of some sort of DNS
loadbalancer/failover mechanism; other zones following the same
delegation pattern share this behavior.  I haven't yet figured out what
products/configuration guidelines are involved in these cases, though.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Andrews <[email-masked]>
Date: Fri, 20 Jun 2008 13:15:06 +1000

> * Jesper G. H=F8y:
> > I haven't tested extensively, but I have not run into that situation so f=
> ar.

	They also don't appear to answer anything but A and AAAA
	queries.  Or for srv _http._tcp.www.cnn.com.

	Mind you there is nothing really new here.  A lot of load
	balancer vendors seem to feel that they can break the DNS
	protocol with impunity.

	Name and shame may be the only way to correct this behaviour.

	Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]