1. ccTLD/cz/NXDomain

NXDomain response means more than "no such name".


$ dnsq ns cz a.ns.nic.cz

2 cz:
91 bytes, 1+4+0+0 records, response, authoritative, noerror
query: 2 cz
answer: cz 18000 NS b.ns.nic.cz
answer: cz 18000 NS a.ns.nic.cz
answer: cz 18000 NS c.ns.nic.cz
answer: cz 18000 NS d.ns.nic.cz

2. poisoning attack

Reply from the cz Authoritative Server is NXDomain for xxxx.a.ns.nic.cz query.

$ dnsq a xxxx.a.ns.nic.cz a.ns.nic.cz

1 xxxx.a.ns.nic.cz:
81 bytes, 1+0+1+0 records, response, authoritative, nxdomain
query: 1 xxxx.a.ns.nic.cz
authority: nic.cz 1800 SOA a.ns.nic.cz hostmaster.nic.cz 1459343598 10800 3600 1209600 7200

3. SOA

This SOA means that there is nic.cz zone,(NS a.ns.nic.cz etc.)

Only the zone cut exists above ns.nic. No zone cut above includign xxxx.a.ns.nic.cz under nic.cz.

4. defence for Kaminsky - Mueller style poisoning

So if we get the reply that delegates ns.nic.cz to some host,
we can throw it away as poison.

Same for a.ns.nic.cz domain name.

-- ToshinoriMaeno 2016-03-31 05:10:25

5. nic.cz NS

$ dnsq ns nic.cz a.ns.nic.cz

2 nic.cz:
207 bytes, 1+3+0+6 records, response, authoritative, noerror
query: 2 nic.cz
answer: nic.cz 1800 NS a.ns.nic.cz
answer: nic.cz 1800 NS b.ns.nic.cz
answer: nic.cz 1800 NS d.ns.nic.cz
additional: a.ns.nic.cz 1800 A 194.0.12.1
additional: b.ns.nic.cz 1800 A 194.0.13.1
additional: d.ns.nic.cz 1800 A 193.29.206.1
additional: a.ns.nic.cz 1800 28 \040\001\006x\000\017\000\000\000\000\000\000\000\000\000\001
additional: b.ns.nic.cz 1800 28 \040\001\006x\000\020\000\000\000\000\000\000\000\000\000\001
additional: d.ns.nic.cz 1800 28 \040\001\006x\000\001\000\000\000\000\000\000\000\000\000\001

6. zone cuts

query name minimisation / Knot resolver query example and log

...

-- ToshinoriMaeno 2016-03-31 05:17:28

MoinQ: ccTLD/cz/NXDOMAIN (last edited 2021-09-23 14:04:06 by ToshinoriMaeno)