APNIC’s Chief Scientist, Geoff Huston, joins PING to discuss three related presentations by Google, Internet Systems Consortium (ISC), and Mozilla that caught his attention during the recent IETF 114 and DNS-OARC 38 meetings on securing the DNS against spoofing.
Listen now DNS spoofing involves third parties intercepting and responding to queries for benign or malicious purposes, and recent studies show that DNS spoofing has more than doubled since 2016. Google is protecting its DNS service against spoofing using multiple methods including using a combination of DNS cookies, randomizing the choice of nameservers, stripping duplicate queries from outbound queues, performing rate limiting, and unilaterally probing for support of Authoritative DNS over TLS (ADoT). Google projects that these measures will cover 99% of queries after the various rollouts are complete. While such results are impressive, Geoff and others argue that the widespread use of DNSSEC could do the job just as well but with little impact on performance, as ISC’s and Mozilla’s findings in their recent studies have shown. Read more about DNS Spoofing and DNSSEC on the APNIC Blog: Geoff’s Notes from DNS-OARC 38 and IETF 114 for more detail on and links to these presentations. Whac-A-Mole: Six years of DNS spoofing Spoofing packets: What is it, and why do people do it? DNSSEC: The long and bumpy road of algorithm deployment
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ apnic-talk - https://mailman.apnic.net/apnic-talk@lists.apnic.net/ To unsubscribe send an email to apnic-talk-le...@lists.apnic.net
