<html theme="default-dark"><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head><body style="font-family: tt;" text="#000000"><div
style="font-family: tt;"><br><br><span>Viktor Dukhovni wrote on
2020-08-28 18:46:</span><br><blockquote type="cite"
cite="mid:20200829014630.GB44511@straasha.imrryr.org"><pre wrap="">On Fri, Aug 28, 2020 at 06:24:40PM -0400, Puneet Sood via dns-operations wrote:
</pre><blockquote type="cite"><pre wrap="">We (Google Public DNS) have noticed some instances of nameserver
responses for a query coming from a different IP. Our initial plan was
to consider these responses invalid and discard them. However after
reading the text in RFC 1035 and the update in RFC 2181, we wanted to
check what other recursive resolvers are seeing and how they are
handling such responses.
[...]
</pre></blockquote></blockquote><br><pre wrap=""></pre><blockquote
type="cite" cite="mid:20200829014630.GB44511@straasha.imrryr.org"><pre wrap="">Not dropping them further weakens the already poor resistance of
non-DNSSEC replies to off-path cache poisoning attacks. Please
drop these, the solution is up to the server operator.</pre></blockquote><br>+1.
the robustness principle is 180deg out of phase in this case.<br><br><blockquote
type="cite" cite="mid:20200829014630.GB44511@straasha.imrryr.org"><pre wrap="">The operators of such domains need to clean up their network design.
</pre></blockquote><br>that, too.<br><br><div class="moz-signature">-- <br>
<div>Sent from <a
href="https://www.postbox-inc.com/?utm_source=email&utm_medium=siglink&utm_campaign=reach"><span
style="color: rgb(0, 157, 247);">Postbox</span></a></div></div></div></body></html>