Reputation
17,131
Next privilege 20,000 Rep.
Access 'trusted user' tools
Badges
2 31 63
Newest
 Nice Answer
Impact
~1.3m people reached

Jan
31
revised What does “Warning: query response not set” mean in dig output?
added 94 characters in body
Jan
27
comment Setting up a bind forwarder, except for a domain
This is not the correct solution. Either get a proper router (see RFC 5625 on how bad the DNS proxies inside home routers are) or forward your queries to a real DNS server such as Google DNS or OpenDNS.
Jan
27
revised No IPv6 & DNSSEC support on cc-TLD? (practical implications)
added 67 characters in body
Jan
27
revised No IPv6 & DNSSEC support on cc-TLD? (practical implications)
added 153 characters in body
Jan
26
comment Do internet standards require reverse DNS for every device?
oops - my mistake, I was thinking 1034 + 1035, not 1033 !!
Jan
26
revised No IPv6 & DNSSEC support on cc-TLD? (practical implications)
added 77 characters in body
Jan
26
comment No IPv6 & DNSSEC support on cc-TLD? (practical implications)
@AndrewB ah, yes, thanks for the reminder of BCP 91.
Jan
26
answered No IPv6 & DNSSEC support on cc-TLD? (practical implications)
Jan
26
comment No IPv6 & DNSSEC support on cc-TLD? (practical implications)
The most commonly used DLV server is run by ISC, not by ICANN - that's the one that's getting turned off in 2017 - dlv.isc.org
Jan
20
awarded  Nice Answer
Jan
11
comment What rate limiting options are provided by ISC BIND?
@kasperd actually there are folks that have used DNS RRL on recursive servers with some success.
Jan
7
comment What kinds of security vulnerabilities does providing DNSSEC expose?
I didn't say "rate limiting" - you did. This answer was very clearly talking about DNS RRL.
Jan
7
comment What kinds of security vulnerabilities does providing DNSSEC expose?
@kasperd it's not in an RFC (and there's no reason it had to be). It's described at ss.vix.su/~vixie/isc-tn-2012-1.txt
Jan
7
comment What kinds of security vulnerabilities does providing DNSSEC expose?
@kasperd No, I mean read up on DNS RRL as specified by the author of this post, as originally implemented for BIND and then implemented almost identically in the other leading authoritative DNS servers.
Jan
7
comment What kinds of security vulnerabilities does providing DNSSEC expose?
@kasperd you should read up further on RRL. Some packets may be dropped, but there's a "slip" factor which results in a truncated UDP response being sent. A legitimate client will then retry over TCP.
Jan
7
comment What kinds of security vulnerabilities does providing DNSSEC expose?
@kasperd the installed base is always a problem - there's no solution that will work even on the compliant installed base, let alone the non-compliant systems out there. The good news is that EDNS cookie support is already in the codebase for BIND 9.11 and (AIUI) will be turned on by default.
Jan
6
comment What kinds of security vulnerabilities does providing DNSSEC expose?
The idea of whitelisting a client that tried TCP has been considered, but is apparently patented.
Jan
6
comment What kinds of security vulnerabilities does providing DNSSEC expose?
find a more clueful DNS provider - their excuses are spurious.
Jan
6
comment What kinds of security vulnerabilities does providing DNSSEC expose?
@kasperd see "draft-ietf-dnsop-cookies", currently progressing through IETF.
Jan
6
comment What kinds of security vulnerabilities does providing DNSSEC expose?
@AndrewB that can't be the Real Paul™, there are capital letters in his post! ;-)