[dns-operations] Maybe I'm just not with it...

[Chris Thompson]

On Dec 6 2009, Joe Greco wrote:

>Can anybody imagine what the advantage of this is?
>
>Non-authoritative answer:
>1.1.20.123.in-addr.arpa name = localhost.
>
>Authoritative answers can be found from:
>20.123.in-addr.arpa     nameserver = vdc-hn01.vnn.vn.
>20.123.in-addr.arpa     nameserver = hcm-server1.vnn.vn.
>
>Appears to be that way for that /16 at least.  

It's a wildcard RR, in fact:

$ dig +noall +answer ptr '*.20.123.in-addr.arpa.'
*.20.123.in-addr.arpa.  86379   IN      PTR     localhost.

>                                              I can see a generic
>response of some sort, but this almost seems like someone's trying
>to exploit misconfigurations maliciously.

There are some amazing things out there in in-addr.arpa space. Don't
assume malice until you have eliminated stupidity...

-- 
Chris Thompson               University of Cambridge Computing Service,
Email: cet1 at ucs.cam.ac.uk    New Museums Site, Cambridge CB2 3QH,
Phone: +44 1223 334715       United Kingdom.