4 ms·

I believe Comcast stopped this as of their network-wide DNSSEC deployment. Either way, the article provides a pretty interesting way around it, but I can't exp

by DHowett 14y ago

I believe Comcast stopped this as of their network-wide DNSSEC deployment. Either way, the article provides a pretty interesting way around it, but I can't expect ISPs hell-bent on false lookup spoofing to sit on their hands for long enough to make this a practical long-term solution.

hextraorinary 14y ago
That's one benefit of DNSSEC. If an ISP adopts it, including NSEC, they can't also do NXDOMAIN spoofing with their DNS servers. Mutually exclusive. But for ISP's that insist on doing this, there are various workarounds besides the one mentioned in the blog post. It's quite easy. Tunneling inside HTTP is a last resort. At some point it's not worth the trouble for the ISP, e.g., to peek into every packet trying to stop users from getting a proper NXDOMAIN response.