News for hackers. Stuff that matters.

A comment on 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?. Parent comment

Re:1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced? by michaelmior on Friday March 30, 2018 @12:40PM (#16717613)
I thought NXDOMAIN responses indicated that the domain doesn't exist and there wasn't a way to actually direct the user anywhere. Your resolver could of course lie and return an IP instead of NXDOMAIN however. Perhaps I'm wrong.
[ Parent | on HN ]
Re:1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced? by duskwuff on Friday March 30, 2018 @01:34PM (#16718100)
They take the "lie" route:

    # dig +short this-should-be-a-nxdomain.com @4.2.2.2
    198.105.254.11
    104.239.213.7
They do it a little more cleanly than some other attempts I've seen, but there's still flaws in their approach. In particular, they will generate redirects for NXDOMAIN responses to certain records under domains that do exist:

    # dig +short why-does-this-resolve.example.com @4.2.2.2
    198.105.254.11
    104.239.213.7
Specifically, they'll generate a redirect for any record that starts with the letter "w". (No, I'm not kidding. Try it.) Other records generate a real NXDOMAIN.
[ Parent | on HN ]
Re:1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced? by michaelmior on Friday March 30, 2018 @03:20PM (#16719009)
Right, what I meant is that you can't return an NXDOMAIN response that "redirects" the domain. (Of course this isn't really a redirect per-se.)
[ Parent | on HN ]
Re:1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced? by hoschicz on Friday March 30, 2018 @04:28PM (#16719553)
You are correct, their resolver is basically lying.
[ Parent | on HN ]