It is possible for any name server on the internet to become "Authoritative" for legitimate, and illegitimate zones.
For example, I can add microsoft.com to my internal name server. As long as I add the required records for www, msdn, technet.microsoft.com everything will work fine. However I'm not a legitmate owner of microsoft.com (according to the
.com DNS servers)
DNS has a feature where it will also include
Additional records in a response for these fake "NS" of a legit name server.
When this happens, a DNS client should be smart enough to discard the Additional record, and to traverse the DNS hierarchy from the root, to the proper location. In this case, the DNS Client (recursive resolver) will look at :
- The root servers
- The com servers
I've been querying a variety of DNS servers and noticed a wide inconsistency in how the
Additional records section is used.
Some DNS servers include A Record information (in the Additional section) for servers they aren't authoritative for.
Example: Question: CNAME (or ALL) for host.example.com. Answer: host.otherguy.com (then in the additional -> A record for host.otherguy.com is 18.104.22.168)
I would think that this would be a DNS cache poisoning attempt if the A record is cached and the NS for "otherguy.com." says the IP is 22.214.171.124.
Is there a concise set of rules that describe the 99% percent of responders, and what to expect?
Conversely, are there are set of rules that define when DNS queries are invalid?
I would think that the answer I'm looking for is like this:
If the DNS server encounters a FQDN that is not equal to the current traversal location, then it must discard any additional records that are sent in the query, and traverse the DNS hierarchy from the root.