What DNS is Not 0 Kylie Brown, Jordan Eberst, Danielle Franz Drew Hanson, Dennis Kilgore, Charles Newton, Lindsay Romano, Lisa Soros 0 Paul Vixie What DNS Is Not. Queue volume 7, issue 10.

DNS: An Overview Companion Paper o DNS Complexity - Published in ACM's Queue, Volume 5 Issue 3, April DNS Complexity o

DNS: An Overview GIANT Database DNS translates a domain name into an IP address. Why is this hard? o Billions of IP addresses in use o Billions of daily DNS requests o Constantly changing Human Convenience

How Does DNS Work? Example: Request for IP address sent to your web browser o Cached if you have visited recently If not, a search begins.

How Does DNS Work? The search process starts at the root name servers. The root servers refer the resolver to the.COM name servers. Request IP addresses for the Facebook name server Request IP address of from the Facebook name servers. Web browser caches IP address

What DNS is Not: Overview Misuses of DNS o DNS is not a routing protocol o DNS is not a tool to monetize typos o DNS is not a directory system This paper talks about different properties that allow DNS to be misused, the common practices of misuse, and the consequences of misuse.

Stupid DNS Tricks

DNS is not a routing protocol Content Distribution Networks (CDNs) often use DNS queries as an opportunity to route user requests. o E.g., Akamai, Cisco DistributedDirector Users are routed to an appropriate content server based on their geographic / network proximity and content server load. Problems o This scheme requires limiting caching (i.e., low TTL) and increases load on DNS infrastructure. o Most end-users are using their ISP's recursive name servers. This hides the user's original location and decreases the accuracy of DNS-based routing.

NXDOMAIN Remapping

Expected Causes of NXDOMAIN: Typo (e.g., Broken Link Hardware or Software Error What should happen: Browser catches bad domain name: “Error page” - “bounced ” NXDOMAIN Remapping

What you should see Googler.com

What you usually see Bestbuyt.com

Many major ISPs' DNS servers (e.g., Comcast) and some public DNS servers (e.g., OpenDNS) redirect users to these spammy search pages. VeriSign example (2006): Added a wild card on top of the.com zone Prevented NXDOMAIN returns. Any non-existent domain, regardless of DNS servers used, was redirected to SiteFinder's website. A Growing Problem

NXDOMAIN is important. Some things depend on accurate negative results. 1. Web security o Many sites, like Google, use wildcard cookies so users can maintain sessions over sub domains (Google Docs, Google Sites, etc). o If sdfgaj.google.com. is redirected to a search page, web browsers will send user cookies.

NXDOMAIN is important. Some things depend on accurate negative results. 1. Web security, continued o In 2008, Dan Kaminsky found a cross-site scripting vulnerability in Earthlink's search page. o Earthlink customers were vulnerable to HTML or Javascript injection on arbitrary domain names because of NXDOMAIN hijacking.

NXDOMAIN is important. Some things depend on accurate negative results. 2. (SMTP) o If a MX (mail exchange) lookup returns no results, a SMTP server will fall back to a standard A record lookup. 1 o These DNS requests are indistinguishable from, say, web browsers' requests. The request will be redirected to a search page. o SMTP server will attempt to send to the wrong IP address. 1 See RFC 5321, section 5.1.

Standard Bad Practices In 2009, there was an effort by national cable companies to standardize DNS redirection services. 2 The standard outlines an opt-out DNS redirect search engine / malware filter and a "Legally-Mandated DNS Redirect Domain List" for "illegal domains." 2 "Recommended Configuration and Use of DNS Redirect by Service Providers"

Solution: DNSSEC

A Rescue Being Thought of DNSSEC is a set of protocol enhancements for DNS. Allows zones to be signed and verified by public-key encryption and signed using private keys by zone editors. All query responses, including NXDOMAIN, are signed. This prevents man-in-the-middle attacks. But, right now, most resolvers are configured to accept unsigned responses. DNSSEC needs wider adoption.

A Rescue Being Thought of DNSSEC won't prevent CDNs' DNS-based routing schemes as it is possible to have a collection of signed, authortative responses.

Directory Services

Some web browsers attempt to auto-complete DNS queries as a user types in the URL bar. If a user types " >.cn is the ccTLD for China, so this is a valid domain >.co is the ccTLD for Columbia. This causes unnecessary traffic to and cnn.co name servers. Domains are not in an ideal format for these directory lookups. E.g.,.com.cnn.www