Unresolved Issues

Abstract

The modern Internet relies on the Domain Name System (DNS) to convert between human-readable domain names and IP addresses. However, the correct and efficient implementation of this function is jeopardized when the configuration data binding domains, nameservers and glue records is faulty. In particular lame delegations, which occur when a nameserver responsible for a domain is unable to provide authoritative information about it, introduce both performance and security risks. We perform a broad-based measurement study of lame delegations, using both longitudinal zone data and active querying. We show that lame delegations of various kinds are common (affecting roughly 14% of domains we queried), that they can significantly degrade lookup latency (when they do not lead to outright failure), and that they expose hundreds of thousands of domains to adversarial takeover. We also explore circumstances that give rise to this surprising prevalence of lame delegations, including unforeseen interactions between the operational procedures of registrars and registries. CCS CONCEPTS• Networks → Naming and addressing; Public Internet.

Everything in its right place: Improving DNS resilience

“…Consequently, our results interact with active DNS infrastructure. We observed ∼12% unresponsive SLDs, which is consistent with the findings of Akiwate et al [72].…”

“…Due to the significant impact these best practices have on increasing the resilience of the DNS ecosystem, we have identified them as critical. These practices have been expressed in several RFCs [21,39,118] and have been confirmed to be of fundamental relevance by previous academic studies ( [71], [72], and chapter 6).…”

“…the DNS ecosystem. Akiwate et al found that lame delegations are surprisingly common, even in popular domains [72]. The consolidation of the Internet and DNS ecosystem, which we also observe in anycast adoption, has also been studied.…”

“…In the previous chapter we expanded on this topic by providing an extensive characterization of the adoption of anycast in DNS authoritative infrastructure, showing a massive adoption for half of the domains measured. Akiwate et al characterized the 6RSDoS Dataset: November 2020-March 2022prevalence of lame delegations on the DNS ecosystem and their negative impact on resilience and performance[72]…”

How Ready is DNS for an IPv6-Only World?

“…Such studies use various active datasets, e.g., OpenINTEL [36], as well as passive datasets, e.g., the Farsight SIE dataset which we rely on, to, e.g., study operational aspects of the DNS [23]. More specifically focusing on DNS (mis)configuration, Sommese et al [42] study inconsistencies in parent and child NS sets and Akiwate et al [1] work on lame delegation. However, contrary to our work, the latter two either do not consider the IP part of DNS delegation (Sommese et al), or explicitly focus on IPv4 (Akiwate et al).…”