[dns-operations] K-root in CN leaking outside of CN

[Davey Song]

AFAIK, the root server instances in China are not expected to serve queries
outside of China. They are called local Root instances when they are
introduced.

It is true as Liman said no one wishes to inflict problems on clients
outside China.
There are must be a network error I think which allows resolvers out of
China to reach it.

Network errors always happen, so the old issues will happen again. Sad.

Davey


On Mon, 8 Nov 2021 at 16:15, Anand Buddhdev <anandb at ripe.net> wrote:

> Hi Davey, Manu,
>
> The server we operate in Guangzhou was indeed reachable from outside
> China. This is not the intention, of course. On Saturday, when we got
> notification about this, we withdrew the prefix from the server, and we
> are communicating with the host to solve this.
>
> Many people have already said this, but I'd like to make it clear that
> the K-root server was NOT emitting false responses for Facebook and
> WhatsApp. The responses were being modified by something between the
> server and its clients.
>
> Regards,
> Anand Buddhdev
> RIPE NCC
>
> On 08/11/2021 08:45, Davey Song wrote:
>
> > If it is urgent, I suggest the K root operator withdraw the route of the
> > instance in Guangzhou immediately.
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20211109/14654c19/attachment.html>