4 ms·

Run your own nameserver(s)?

by mhurron 15y ago

lhnn 15y ago
Still wouldn't help, I don't think. Your DNS server is likely just a caching server, which means it forwards requests to another, third party server.
- mhurron 15y ago
  Mine isn't. I would assume that if you wanted to set up a nameserver you'd be able to handle the slight change of adding a root.hints.
- pwaring 15y ago
  You can set up your own resolver - I've done this in the past when I've been with an ISP with dreadfully slow nameservers (they weren't doing any interception, just the service was bad).
- y0ghur7_xxx 15y ago
  You can install PowerDNS recursor[1] or BIND on you own server and use that instead of your ISP/google DNS. [1]http://doc.powerdns.com/built-in-recursor.html http://doc.powerdns.com/built-in-recursor.html
kogir 15y ago
Won't help. If the ISP is intercepting all outbound DNS queries, it will also intercept those made by your server. In case it's not clear, even non-forwarding DNS servers have to make DNS queries to the authoritative servers of each domain. It may stop invalid results for top level domains (queries to the root servers might not be intercepted), but would likely still serve ads for invalidsubdomain.validdomain.com. This is one of many reasons why we need broad DNSSEC adoption.
- SnowLprd 15y ago
  Broad DNSSEC adoption would have to include NSEC, which is needed to authenticate that the resource does indeed not exist. More on NSEC here: "All records are signed offline. When a nameserver receives a query it looks up the answer plus the signature and returns the two (RRSIG + RRset) to the resolver. The signature is thus not created in real time. How can a secure-aware nameserver then respond to a query for something it does not know (that is, give an NXDOMAIN answer)? The only way to have offline signing and NXDOMAIN answers work together is to somehow sign the data you do not have. In DNSSEC this is accomplished by the Next SECure (NSEC) record. This NSEC record holds information about the next record; it spans the nonexistence gaps in a zone, so to say." Source: https://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_7-2/dnssec.html https://www.cisco.com/web/about/ac123/ac147/archived_issues/...
  - tptacek 15y ago
    This is outdated information. The NSEC record did confirm the nonexistence of DNS names. It also confirmed the identity of every record in your zone; in other words, it allowed anyone in the world to dump your whole zone. The namedroppers working group eventually conceded that, no, it wasn't OK to disclose every domain name signed under DNSSEC; that, for instance, virtually every large enterprise in the world had made a practice of setting up dual-facing DNS so that the world only saw a preapproved subset of their name. And so we got the NSEC3 protocol, which uses a hashing scheme similar to Unix password files. So now, instead of directly dumping domains, attackers get to crack them. Daniel J. Bernstein has a couple presentations about how easy this is. DNSSEC is a bit of a debacle.
    - SnowLprd 15y ago
      It does indeed seem that way, unfortunately. Is too optimistic to think a better standard might emerge?

Run your own nameserver(s)?

by mhurron 15y ago

Run your own nameserver(s)?

lhnn 15y ago

Still wouldn't help, I don't think. Your DNS server is likely just a caching server, which means it forwards requests to another, third party server.

mhurron 15y ago
Mine isn't. I would assume that if you wanted to set up a nameserver you'd be able to handle the slight change of adding a root.hints.
pwaring 15y ago
You can set up your own resolver - I've done this in the past when I've been with an ISP with dreadfully slow nameservers (they weren't doing any interception, just the service was bad).
y0ghur7_xxx 15y ago
You can install PowerDNS recursor[1] or BIND on you own server and use that instead of your ISP/google DNS. [1]http://doc.powerdns.com/built-in-recursor.html http://doc.powerdns.com/built-in-recursor.html

kogir 15y ago

Won't help. If the ISP is intercepting all outbound DNS queries, it will also intercept those made by your server. In case it's not clear, even non-forwarding DNS servers have to make DNS queries to the authoritative servers of each domain. It may stop invalid results for top level domains (queries to the root servers might not be intercepted), but would likely still serve ads for invalidsubdomain.validdomain.com. This is one of many reasons why we need broad DNSSEC adoption.

SnowLprd 15y ago
Broad DNSSEC adoption would have to include NSEC, which is needed to authenticate that the resource does indeed not exist. More on NSEC here: "All records are signed offline. When a nameserver receives a query it looks up the answer plus the signature and returns the two (RRSIG + RRset) to the resolver. The signature is thus not created in real time. How can a secure-aware nameserver then respond to a query for something it does not know (that is, give an NXDOMAIN answer)? The only way to have offline signing and NXDOMAIN answers work together is to somehow sign the data you do not have. In DNSSEC this is accomplished by the Next SECure (NSEC) record. This NSEC record holds information about the next record; it spans the nonexistence gaps in a zone, so to say." Source: https://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_7-2/dnssec.html https://www.cisco.com/web/about/ac123/ac147/archived_issues/...
- tptacek 15y ago
  This is outdated information. The NSEC record did confirm the nonexistence of DNS names. It also confirmed the identity of every record in your zone; in other words, it allowed anyone in the world to dump your whole zone. The namedroppers working group eventually conceded that, no, it wasn't OK to disclose every domain name signed under DNSSEC; that, for instance, virtually every large enterprise in the world had made a practice of setting up dual-facing DNS so that the world only saw a preapproved subset of their name. And so we got the NSEC3 protocol, which uses a hashing scheme similar to Unix password files. So now, instead of directly dumping domains, attackers get to crack them. Daniel J. Bernstein has a couple presentations about how easy this is. DNSSEC is a bit of a debacle.
  - SnowLprd 15y ago
    It does indeed seem that way, unfortunately. Is too optimistic to think a better standard might emerge?