DNS安全笔记

备注

https://github.com/abbypan/dns-security-notes

目录

根

• 说明
• 根镜像(Anycast)
• root scheme analysis

顶级域

• TLD(顶级域)

递归

• Recursive Resolver
• 公共递归
• forwarding recursive resolver
• open resolver (开放递归)
• recursive option test
• 分析
• 检测原理
• 注意
• recursive security
• recursive cache flush
• improvements to dns resolver

权威

• Lame Nameserver
• authoritative server
• Glue Requirements
• latency
• delegation req
• NS revalidation

RR

• CHAOS
• NS
• deleg
• SVCB
• SRV
• APL
• DNSSEC RR

security

• tsig
• dnssec
• nsec
• NSEC3PARAM iteration count
• NSEC + wildcard 的实现缺陷
• NSEC5
• nxdomain nsec/nsec3
• nxdomain black lies
• DNSCURVE
• resolverless
• Hijack (劫持)

Extension

• EDNS0
• multiple responses
• no response
• catalog zone
• attrleaf
• Extended DNS Errors

DANE

• TLSA
• PMTA
• IPSECA

privacy

• 隐私
• 现行DNS解析架构下的隐私方案
• doc
• ecs
• EIL
• namecoin
• DNSSD Privacy
• confidential dns
• start TLS for DNS
• Knell for DNS
• IP Anonymization

qos

• DNS解析性能影响参数
• cache dns/forwarding resolver 评测指标

Local

• Split DNS Configuration for IKEv2
• DNS Name Autoconfiguration for Internet of Things Devices
• mdns ( Multicast DNS )

DDoS

• DNS Cookies
• long ttl
• disposable domain query
• rrl

Service

• httpdns
• DOH
• DNS-SD ( DNS-Based Service Discovery )
• hybrid dnssd
• Attested DNS

software

• dns software fingerprinting
• bind
• pcap

app

• Diameter S-NAPTR
• The ORIGIN HTTP/2 Frame
• Secondary Certificate Authentication in HTTP/2
• iot dns autoconf

Attack

• Injection
• dnssec keytrap
• NS Attack
• DDoS
• Configure Error 配置错误
• Hijack
• Management 管理权

STD

• NIST SP 800-81r3 Secure DNS Deployment Guide

other

• intro