bk99.de entertain the web since 1997

bk99.de
Hostblogger · DNSCurated

Running secondary name servers across organisations

Summary

Manuel Schmitt describes a mutual secondary DNS arrangement between manitu and the Max Planck Institute in Saarbrücken. The Max Planck Institute already provided additional name servers for manitu.de and manitu.net. In return, manitu took over secondary DNS for some reverse zones.

Ideas

  • Secondary name servers spread authoritative DNS zones across independent operators.
  • Mutual help can create technical redundancy without a shared platform provider.
  • Reverse DNS zones are a controlled first step before more important domains.

Insights

  • Organisational independence increases the value of technical redundancy.
  • Cooperation between operators can be more robust than several instances at the same provider.

Facts

  • Further important domains were to follow afterwards.

Recommendations

  • Place authoritative name servers in independent networks and areas of responsibility.
  • Monitor zone transfers, serial numbers and the reachability of every secondary.

References

Read the original article on Hostblogger

Search the Web Archive

Hostblogger · 2017

Making CAA records available in the DNS zone editor

At customers’ request, Manuel Schmitt adds the CAA resource record type to his hosting company’s DNS zone editor. The CAA type was enabled in the zone editor on 27 January 2017. According to the article, the extension came about at the request of many customers.

KrebsOnSecurity · 2019

DNSpionage: When the registrar becomes the attack path

Brian Krebs reconstructs an espionage campaign that manipulated registrar accounts and DNS records to intercept the email and VPN access of numerous organisations. Netnod confirmed that its registrar account had been compromised. The attackers obtained certificates for manipulated mail destinations.

RFC · 2018

RFC 8484: DNS over HTTPS

RFC 8484 encapsulates DNS queries in HTTPS and thereby uses existing web transport and authentication mechanisms. DoH makes path-based observation and classic network diagnostics harder at the same time. Choosing the resolver remains a decision of trust.