Re: IN TXT & NULL trash records

[ѽ҉ᶬḳ℠ via Unbound-users]

The OP mentioned the cache started to store totally useless records of type TXT and NULL. Whilst TXT records could serve a legitimate purpose, e.g. SFP/DKIM/DMARC, there appears not legitimate purpose at all for NULL records, according to https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml and subsequent https://tools.ietf.org/html/rfc1035. Thus I would reckon the OP has a valid point of questioning NULL records being cached by unbound, or even served to querying clients at all. There seems to be no mechanism however in unbound to prevent such. I might be mistaken but the QTYPE=NULL Key Tag query pertaining to DNSSEC as in https://tools.ietf.org/html/rfc8145#section-5.1 does not query an actual NULL record but rather specifies Anything at all may be in the RDATA field so long as it is 65535 octets or less. On 22.11.2018 15:12, I via Unbound-users wrote: Hi, Rate-limiting queries per source IP with specific query type (NULL/TXT) and long qname (e.g. 20 byte or longer). That should be possible using iptables hashlimit module and dns-extension [1]. That will make DNS-tunnel VPN useless while accepting legitimate TXT/NULL queries. [1] https://github.com/mimuret/iptables-ext-dns