Winfried Angele 🇺🇦🇪🇺

@jpmens@mastodon.social yes, you're absolutely right! I have a scenario in mind where I control the clients' resolvers and make my own unsigned domains/services more resilient against such incidents

@jpmens@mastodon.social If I understand correctly, unsigned 'de' zones for which an NTA existed would not have been affected by the incident

@jpmens@mastodon.social but I read that it's not common practice to sign referrals. https://datatracker.ietf.org/doc/html/rfc4035#appendix-B.5

@jpmens@mastodon.social proactive mitigation idea: permanent NTAs for zones that you are sure are not, and will not be, signed. But I'm not sure if the (signed) referrals (NS RRs) of the parent would work once they have expired

@jpmens@mastodon.social I guess for nonexistent DS RRs it's the 'minimum' of the de. SOA RR which is 2h. But resolvers may have shorter overwrites.

@jpmens@mastodon.social "particularly when the absence of the DS record must be ‘proven’ for an unsigned child zone." I wonder when and how often a resolver checks for the presence of the DS in a parent zone. Because it escalated very quickly

@simon_m@infosec.exchange Yes, DNS resolver operators have implemented workarounds (NTA for de). DENIC has since fixed the issue. A post-mortem report is still pending

@tagesschau@ard.social Pflanzen absorbieren CO2? Was für eine geniale Entdeckung

@gunstick@mastodon.opencloud.lu now you lost a piece of entropy ;)

@otto @cstrotm @miek yes, turning off packet cache helps! I remember one case 3 years ago where we implemented this for 1 zone because of a complaint from a CDN. No one else has complained since. Apparently not a general problem

@cstrotm @miek some resolvers don't rotate the RRs of a RRset anyway. IIrc, that's the case with the PowerDNS Recursor and dnsdist. IMHO RRsets are not a use case for redundancy but for load sharing. Since the queries usually come from different resolvers, this is nevertheless achieved