0

Our company controls the domain example.com. We have a partner to whom we would like to delegate the subdomain sub.example.com, so that they can use it to create any records from and under this node (CNAME, SPF records, etc.). They would like to use Amazon's Route53 DNS service to manage this zone.

As I understand the AWS documentation, what our partner needs to do is:

  • create a DNS zone named sub.example.com ;
  • create whatever records they want in this zone.

Then on our side we need to update the NS records for the sub.example.com subdomain to our partner's DNS service name servers, and voilà, the subdomain is delegated.

But what prevents a malicious company with an account in Amazon Route53 to create its own sub.example.com zone and use it to conflict with our partner's? I can create a zone named www.google.com in Route53, surely there's no verification at this point. Is it just AWS Route53 that forces unicity for each pair "name servers / DNS zone", so that no two AWS accounts can have the same zone with the same name servers?

Improve this question

2 Answers 2

Reset to default
0

It's the NS delegation you described above which protects you from abuse.

If I am a DNS client and I want to lookup xxx.sub.example.com, then in principle I do something like this:

  1. I check my configured list of root name servers;
  2. I ask one of the root name servers for a name server for .com;
  3. I ask the .com server for a name server for example.com;
  4. I ask the example.com name server for a name server for sub.example.com;
  5. Then I ask that name server to resolve xxx.sub.example.com.

So I can build an evil name server which serves up wrong answers for the sub.example.com domain but step #4 (which you control) means no real client will ever call me. (This isn't particular to Route53; just how DNS works)

Improve this answer
2
  • Your explanation is not exactly what happens. 1) you typically use a recursive nameserver that does the iteration you list, and 2) at each step, historically, the whole name is checked, not label per label. This has changed with QNAME minimization
    – Patrick Mevzek
    Jun 2, 2021 at 21:50
  • @lupin: I get that, but in the example I give the attacker uses the same DNS service as the client. There is no "evil name server", there are only name servers provided by the DNS service when creating the DNS zone.
    – Maxime Rossini
    Jun 3, 2021 at 16:58
0

After further investigations, what I found out is that all DNS services do not handle this case in the same way.

On one hand, Amazon Route53 owns multiple name servers, so they can guarantee that two identical DNS zones created by different clients are never declared in the same name servers (as long as the zone is not declared by more clients than the number of primary name servers they can use for a single zone).

On the other hand, OVH prevents a client from creating a DNS zone which has already been declared in their name servers by another client.

Note that this last behavior could be abused by an OVH client declaring a DNS zone before its legitimate owner or delegatee. For example, if Google has not declared www.google.com in the OVH DNS service, I can declare this zone, then Google won't be able to delegate www.google.com to any other OVH client (of course they will be able to delegate the domain to a client using another DNS service).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.