The following is not specific to BIND, but concerns the operating
environment for DNS software. Ebersman in a later post links to a document
which foreshadows what I'm about to discuss.
On Mon, 30 Sep 2019, Petr Mensik wrote:
[...]
I am aware search is a no-no in DNS community.
That's barely the "other 10%" of it. It reaches as far as cooked Google
servers (Stucke's still amusing talk from Black Hat some years ago) and
comes down to a simple: "whose name do you trust?"
I know from experience with the data that in some $VENDOR's streaming
NXDOMAIN telemetry feed, on any given day, depending which way the wind is
blowing, that .belkin will be one of the top 10 TLDs. Luckily Cisco bought
.cisco, so you can see for yourself if your Passive DNS data provider is
any good by looking for A queries which resolved to 127.0.53.53.
Why does so much DNS traffic show up inadvertently stemmed with .cisco and
.belkin? Rhetorically speaking, of course.
The DNS is just one naming service which is queried in attempts to resolve
resource names into actual instances. Others include hosts, LDAP, NIS, you
get the idea. If you go down the "no search lists" path, then that means
everywhere, not just the DNS. (This may also be part of the reason for
inconsistent behavior; earlier this year I personally saw DNS lookups
suddenly become case sensitive on SuSE Leap when using getaddrinfo().)
What about Active Directory? If your domain can't resolve inside of
Windows, does it fall back to the DNS?
Resources doesn't include just web sites, CRLs, adverts, tracking beacons.
It includes database servers, etcd and other resolution / configuration
services, drives containing executables to, you know, execute...
It doesn't stop with best practices according to the DNS community. Plenty
of developers will think they know best for their particular situation, so
you will see them trying various things that will oftentimes result in
stemming and trying things from your search list. (Guilty as charged,
during the SuSE episode I coded an option to force the use of dnspython
for name resolution.)
Prohibitions like "no search lists" do next to nothing. Clever programmers
will use whatever domain you specify for your hosts as something to
deconstruct and use for stemming. An (enforced) search list might be
preferable!
Look at your DNS traffic, particularly NXDOMAIN. (I'd look for stuff
resolving in typoed / bit flipped domains too.)
Add a domain you own but do not use as the final fallback in your search
list, and monitor all DNS traffic going to it.
Even resolving stuff may not stop it from leaking (stop resolution
attempts), because the developer may not trust your answer. I wouldn't do
that, of course. ;-) But clearly people obsessed with "happy eyeballs"
don't share my sensibilities.
Good luck, and a good tomorrow...
--
Fred Morris
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
