160 reputation
18
bio website
location On Air
age 60
visits member for 3 years
seen Mar 15 at 2:02

Mar
6
awarded  Scholar
Mar
6
accepted Is there any standard for DNS <-> IP authentication?
Mar
6
comment Is there any standard for DNS <-> IP authentication?
It makes sense now. So at most it would work only on an internal network & internal/private DNS server.
Mar
6
revised Is there any standard for DNS <-> IP authentication?
added 85 characters in body
Mar
6
revised Is there any standard for DNS <-> IP authentication?
added 7 characters in body
Mar
6
comment Is there any standard for DNS <-> IP authentication?
@AndrewB thanks for the constructive comment. I wasn't aware that the DNS security is so flawed. At least DNSSEC seemed to address the data integrity issue. Is this the only reason why this won't work?
Mar
6
awarded  Commentator
Mar
6
comment Is there any standard for DNS <-> IP authentication?
@wesley ha ha ...I guess I will postpone this project for a while. It seems to work for email authentication (though there may be some shortcomings) so I still can't explain myself why it wouldn't work for http. At least hypothetically it seemed a good method to provide http authentication in a distributed manner based on the IP address of the client.
Mar
6
revised Is there any standard for DNS <-> IP authentication?
deleted 29 characters in body
Mar
6
revised Is there any standard for DNS <-> IP authentication?
added 711 characters in body
Mar
6
comment Is there any standard for DNS <-> IP authentication?
@Wesley I think the question was badly formatted.See the edit. It can't be a such bad idea to get 2 down-votes :)
Mar
6
revised Is there any standard for DNS <-> IP authentication?
added 711 characters in body
Mar
6
comment Is there any standard for DNS <-> IP authentication?
@BillThor The HTTP request servers can be restricted(firewalled) for incoming traffic so I think they are "easier" to secure than a webserver or email server which must accept arbitrary traffic so that it can function properly.
Mar
6
revised Is there any standard for DNS <-> IP authentication?
edited tags
Mar
6
comment Is there any standard for DNS <-> IP authentication?
@BillThor all the websites have their IP addresses published as MX, TXT, A, AAAA or whatever records so I'm not sure how publishing an additional kind of record would make it worse. Like SPF records authenticate the email servers to send emails on behalf of that specific domain the TXT records I was thinking would authenticate the HTTP Request servers to make requests on behalf of that domain.
Mar
6
comment Is there any standard for DNS <-> IP authentication?
@MarkHenderson it's actually the web server which checks the DNS and matches it against the request IP not the other way around. You can't do .htaccess because each resource owner has its own policies. Think about Amazon S3 which is a public service and each owner can set various ACL policies one of them being an IP restriction. I was thinking that the DNS / TXT records would simplify the management of the IP restrictions/ management.
Mar
6
comment Is there any standard for DNS <-> IP authentication?
@BillThor I think same can be said about the SPF records and still not many hack these servers to send spam.
Mar
6
comment Is there any standard for DNS <-> IP authentication?
I should also mention that each resource owner specifies the ACL policies (e.g. IP restricted or not) so I can't just firewall the web server.
Mar
6
comment Is there any standard for DNS <-> IP authentication?
You don't need to drop the connection. I think an "unauthorised" error would be enough. The DNS is meant to help the resource owner to manage the permissions easier. It would organise its services/applications into "domains/subdomains" instead of raw IP ranges. That way if it removes a service or just needs to migrate it to a new infrastructure it would need to remove/update the domain/subdomain records only.
Mar
6
asked Is there any standard for DNS <-> IP authentication?