![]() |
|
Message-ID: <0c74e187cfd2bc6ca5d8af3b3a367859bdbfe984@linux.dev> Date: Mon, 24 Jun 2024 04:35:24 +0000 From: "Lance Yang" <lance.yang@...ux.dev> To: "Rich Felker" <dalias@...c.org>, "Thorsten Glaser" <tg@...bsd.de> Cc: musl@...ts.openwall.com, "Jan Mercl" <0xjnml@...il.com>, "Lance Yang" <ioworker0@...il.com> Subject: Re: [PATCH 1/1] improve DNS resolution logic for parallel queries June 24, 2024 at 3:23 AM, "Rich Felker" <dalias@...c.org> wrote: > > On Sun, Jun 23, 2024 at 06:52:54PM +0000, Thorsten Glaser wrote: > > > > > Lance Yang dixit: > > > > > > > > I understand your concern that continuing the search after receiving an > > > > NXDOMAIN response might pose a security risk. Will look into this issue > > > > > > > > It’s not (just) a security risk, it’s how DNS works. > > > > > > > > NXDOMAIN means “I am a nameserver responsible for resolving your > > > > query, and I can state with confidence that the entry you requested > > > > does not exist” so no other responsible nameserver’s response can > > > > rightly differ. Yep, I got it wrong, thanks for clarifying! > > > > Moreover, if you're using a nameserver that validates DNSSEC it means > > "I am a nameserver.... and I have witnessed cryptographic proof that > > the name you requested does not exist or that the delegating authority > > at one level of the hierarchy made a delegation that opts out of > > further cryptographic validation." Thanks again for the lesson! Lance > > Rich >
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.