1

We all know that when I ask for some hostname I connect to my DNS server, which checks if it has its corresponding record in cache, and if not it recurs, if necessary, up to the authoritative DNS for that hostname.

Now, in principle an authoritative DNS can account for an enormous amount of records. Take this nodeJS example:

var dnsd = require('dnsd')
dnsd.createServer(function(req, res) {
  res.end('1.2.3.4')
}).listen(53, '')

If I use this as an authoritative server for my domain, any request for any subdomain will result in an A record pointing to 1.2.3.4. This means that, if a bunch of users start asking for random subdomains of my domain, their DNS server will keep asking mine for new records, and caching them.

But my common sense says that, for example, Google's 4.4.4.4 will not be willing to store gigabytes of records only because some bored geek played with two lines of node.

So what happens then? What happens when some DNS has already cached a whole lot of records for some domain and doesn't want to store more? Will the domain get blocked or banned? Will old records be dropped before their TTL expires? Is there any official policy for this?

2

As Calle says, it's implementation specific. I'm going to get into a little more detail though.

The most common approach that nameservers use is a memory based approach. A memory ceiling is defined (either as a default or in the configuration by the user), and under normal operation data is cached until it expires. When the memory ceiling is reached, the software begins to discard less used records in order to free up memory for newer records, usually starting with the oldest data in the cache and possibly considering the least requested data as well.

Many nameserver implementations do not implement any sort of IP based query blacklisting. This is mostly due to how easy it is to spoof an IP addresses in UDP, which would make it far too easy to perform a DNS denial of service against a legitimate IP that needs the data. I could pretend to be your IP, hammer Google's nameservers until they ignore your IP, and then you can't get to Google.com. This would be bad, as without the Google Runbook most of the people at your company would lose the ability to pretend that they know how to do their job. Once you consider the fact that the attacker can simply change the IP address that they're spoofing if they're blocked, IP blacklisting becomes a very unattractive option for most server operators.

Due to the increased popularity of label/hostname cycling attacks directed towards recursive DNS servers (which I won't go into here), more and more software packages are starting to enable options for rate limiting incoming queries based on several criteria. The idea here is not to outright block IPs (because the IP is probably spoofed and it's easy to spoof a different one), but instead make it less effective and therefore unattractive to use the DNS server in these sorts of attacks.

Anyway, the short version is that you usually don't need to worry about someone getting your domain or even your IP "banned" from a recursive DNS server. It's certainly possible if the parties in question are not being leveraged in attacks very often and therefore don't know why it's usually a bad idea to ban domains or IPs, but uncommon. The experienced ones will only ban your domain (temporarily) if their platform is being leveraged to attack the nameservers for your domain, in which case they believe that they're doing you a favor by not sending you queries.

3

Caching behavior is entirely up the implementation. The only requirement is that cached information must be correct (naturally) and must not be older than the TTL says. So the server in your example is free to throw away records as fast and as often as it wants to.

  • Reasonable. I guess my actual question, then, is: is there any chance of actually being banned? Like, could some DNS refuse to service a domain because of that? Because that would practically... ban that domain from the internet! – Matteo Monti Jan 3 '16 at 14:31
  • If you start spewing hundreds of questions per second, you'll probably get the IP address sending the queries blocked fairly soon (I've accidentally done that one myself). I've never heard of anyone blocking due to too much actual content in the same zone. Given that there are plenty of real-life zones with tens or hundreds of millions of records in them, I don't think you need to worry. – Calle Dybedahl Jan 3 '16 at 17:16
  • TENS OR HUNDREDS OF MILLIONS OF RECORDS?? I need an example there, man! – Matteo Monti Jan 3 '16 at 17:19
  • .COM would be in the hundreds of millions. The one I've worked the most with, .SE, was about ten million. – Calle Dybedahl Jan 4 '16 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.