Lecture 20: DNS

• Slides
• Playlist (length: 57:40)

Intro to DNS

DNS Lookup

Assuming the cache is empty, which name servers would a DNS resolver contact to learn the IP address of oh.cs161.org?

The root (.) name server, the .org name server, and the cs161.org name server, in that order.

Domain Names

(True/False) oogle.com is a subdomain of google.com.

False. The domain hierarchy must be separated by dots, so oogle.com is a different domain from google.com. However, both are subdomains of com.

DNS Lookup

Note: The second half of this video walks through the same DNS lookup as the one in video 14.2, so if you feel comfortable with the DNS lookup process, you can stop watching this video at 2:10.

DNS Records

In the previous video, the root responded to a query for eecs.mit.edu with "Don't know, but ask .edu with IP 192.0.0.1." What records represent this reply, and what section is each record sent in?

In the authority section, we include an NS record mapping .edu to a domain representing .edu, such as a.edu-servers.net.

In the additional section, we include an A record mapping a.edu-servers.net to the IP address 192.0.0.1.

DNS Cache Poisoning

If the .edu name server is compromised, what records can the resolver no longer trust?

Any record for a domain ending in .edu can no longer be trusted.

Note that we can still trust records for other domains, such as .com, since .edu cannot provide any records for .com.

DNS Spoofing

If the ID field is randomized, what is the probability an on-path attacker successfully spoofs a DNS packet? Assume the on-path attacker always wins the race against the legitimate response.

100%. Even if the ID field is randomized, the on-path attacker can see the ID field, so they don’t need to guess it.

Kaminsky Attack

How does the Kaminsky attack avoid bailiwick checking (the resolver checking that google.com only provides records for *.google.com)?

The Kaminsky attack makes queries for random subdomains of google.com, so the responses to these queries are allowed to provide a record for google.com.