Home page logo

fulldisclosure logo Full Disclosure mailing list archives

DNS forward only: why does it help?
From: Paul Szabo <psz () maths usyd edu au>
Date: Thu, 24 Jul 2008 07:28:15 +1000

As a workaround, it is recommended to set DNS servers to forward only.
Can someone explain why that helps? Cannot responses from the forwarder
be spoofed same as normal query responses? Is it that "glue RRs" from
forwarders are discarded; or that source ports of forwarded requests are
better randomized than normal queries; or that forwarding is done with
TCP not UDP?

The "published attack" has ns.victim.com spoofed. That does not affect a
server set to forward only. Could the attacker spoof login.victim.com
directly, and would not that affect a forward only server equally?


Paul Szabo   psz () maths usyd edu au   http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics   University of Sydney    Australia

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • DNS forward only: why does it help? Paul Szabo (Jul 23)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]