DNS spoofing is a non-issue if we all do DNSSEC
PING
English - August 17, 2022 18:00 - 39 minutes - 54.2 MB - ★★★★★ - 2 ratingsTech News News Technology Homepage Download Apple Podcasts Google Podcasts Overcast Castro Pocket Casts RSS feed
APNIC's Chief Scientist, Geoff Huston joins us again on the show, this time to discuss three related presentations by Google, ISC and Mozilla that caught his attention during the recent IETF 114 and DNS-OARC 38 meetings on securing the DNS against spoofing.
DNS spoofing involves third parties intercepting and responding to queries for benign or malicious purposes; recent studies show that DNS spoofing has more doubled since 2016.
Google is protecting its DNS service against spoofing using multiple methods including using a combination of DNS cookies, randomizing the choice of name servers, stripping duplicate queries from the outbound queues, performing rate limiting and unilaterally probing for support of Authoritative DNS over TLS (ADoT); it projects that these measures will cover 99% of queries after the various rollouts are complete.
While such results are impressive, Geoff and others argue that the widespread use of DNSSEC could do just as good as a job and with little impact on performance, as per ISC's and Mozilla's findings in their recent studies.
Read more about DNS Spoofing and DNSSEC on the APNIC Blog.
The views expressed by the featured speakers are their own and do not necessarily reflect the views of APNIC.
APNIC's Chief Scientist, Geoff Huston joins us again on the show, this time to discuss three related presentations by Google, ISC and Mozilla that caught his attention during the recent IETF 114 and DNS-OARC 38 meetings on securing the DNS against spoofing.
DNS spoofing involves third parties intercepting and responding to queries for benign or malicious purposes; recent studies show that DNS spoofing has more doubled since 2016.
Google is protecting its DNS service against spoofing using multiple methods including using a combination of DNS cookies, randomizing the choice of name servers, stripping duplicate queries from the outbound queues, performing rate limiting and unilaterally probing for support of Authoritative DNS over TLS (ADoT); it projects that these measures will cover 99% of queries after the various rollouts are complete.
While such results are impressive, Geoff and others argue that the widespread use of DNSSEC could do just as good as a job and with little impact on performance, as per ISC's and Mozilla's findings in their recent studies.
Read more about DNS Spoofing and DNSSEC on the APNIC Blog:
Geoff's Notes from DNS-OARC 38 and IETF 114 for more detail on and links to these presentations.Whac-A-Mole: Six years of DNS spoofingSpoofing packets: What is it, and why do people do it?DNSSEC: The long and bumpy road of algorithm deploymentThe views expressed by the featured speakers are their own and do not necessarily reflect the views of APNIC.