4 ms·
Would an effective mitigation be to drop inbound DNS queries that match those special characters using DPI?
by teeray 1y ago
Would an effective mitigation be to drop inbound DNS queries that match those special characters using DPI?
- recsv-heredoc 1y agoSetting your upstream to 1.1.1.1 or 8.8.8.8 should mitigate this, as these appear to respond with NXDOMAIN to invalid domains rather than fail silently which would close the window for the attack.
- dc396 1y agoNo. The special characters thing is a red herring. All resolvers must handle a lack of response via timeout (particularly since DNS mostly uses UDP). The correct mitigation is turning on DNSSEC. This sort of attack, known since 1993, is why DNSSEC was created.
- deleted 1y ago[deleted]
- karel-3d 1y agoBetter solution that doesn't rely on DNSSEC is use stub resolver that can forward requests on DoH; like unbound or dnsdist. dnsmasq cannot do this and just forwards UDP to UDP and TCP to TCP. (and doesn't know DoT or DoH) DoH (and DoT, DNS over TLS) doesn't have this problem, as the whole thing is secured. (Well, this concrete problem might actually be prevented just by using plain old DNS over TCP, but I am not sure about that.)