3 ms·
The idea given in the talk is simple: keep a whitelist of known recursive name servers who have behaved well in the past. Serve requests coming from these know
by metafunctor 10y ago
The idea given in the talk is simple: keep a whitelist of known recursive name servers who have behaved well in the past. Serve requests coming from these known good IPs with a high priority. Serve all other requests with a lower priority.
- teddyh 10y agoActually, he gives two ideas, the second being that all resolvers should use “NSEC aggressive caching” for DNSSEC signed zones, so compromised devices can’t go around the whitelist from the first idea by using DNS resolvers as proxies.