4 ms·

How can the DNS root alter my records? Say my domain is "example.com" and I serve the zone out of my own authoritative DNS server running on my own host. I cr

by danyork 12y ago

How can the DNS root alter my records? Say my domain is "example.com" and I serve the zone out of my own authoritative DNS server running on my own host. I create a "www" record that I serve out pointing to my site's IP address. Leaving DNSSEC out for a moment, how can the DNS root alter my records? All the DNS root does is provide pointers to the .com authoritative name servers. The .com name servers provide pointers to my example.com name server. My example.com name server serves out the zone data.

MichaelGG 12y ago
I mean the TLD root. Aka the .com registrar.
- danyork 12y ago
  Ah, gotcha. Sure, the .COM registry could return NS records for example.com pointing to a controlled name server that could then return an A record pointing to a controlled web server that wasn't mine. And those false NS records could be modified by the registry (unlikely in the case of .COM but could conceivably be for a ccTLD) or more likely the registrar (after a compromise there).
tptacek 12y ago
I think you're playing a semantic game with the word "alter". The roots can't "alter" your records. They can prevent other people from seeing those records, though, and replace them with an entirely different set of records.
- danyork 12y ago
  I was not playing a game. I was honestly trying to understand because it didn't make any sense to me. I don't see the actual root of DNS being able to do much at all. If the root tried to give altered NS records for one of the TLDs I believe that would be noticed by many out there. The TLD registries could give altered NS records pointing to a controlled authoritative name server for a domain, and then THAT controlled name server could provide an entirely different set of records. (And they could all be DNSSEC-signed.) But to me this is kind of DNS security 101 - you have to trust your parent zones and you have to trust your registrar. If you think that a TLD registry or registrar could do this kind of change... don't use them.

by danyork 12y ago

MichaelGG 12y ago

I mean the TLD root. Aka the .com registrar.

danyork 12y ago
Ah, gotcha. Sure, the .COM registry could return NS records for example.com pointing to a controlled name server that could then return an A record pointing to a controlled web server that wasn't mine. And those false NS records could be modified by the registry (unlikely in the case of .COM but could conceivably be for a ccTLD) or more likely the registrar (after a compromise there).

tptacek 12y ago

I think you're playing a semantic game with the word "alter". The roots can't "alter" your records. They can prevent other people from seeing those records, though, and replace them with an entirely different set of records.

danyork 12y ago
I was not playing a game. I was honestly trying to understand because it didn't make any sense to me. I don't see the actual root of DNS being able to do much at all. If the root tried to give altered NS records for one of the TLDs I believe that would be noticed by many out there. The TLD registries could give altered NS records pointing to a controlled authoritative name server for a domain, and then THAT controlled name server could provide an entirely different set of records. (And they could all be DNSSEC-signed.) But to me this is kind of DNS security 101 - you have to trust your parent zones and you have to trust your registrar. If you think that a TLD registry or registrar could do this kind of change... don't use them.