Re:Spoofing DNS with fragments
by eximius on Monday September 10, 2018 @06:28PM
(#17955726)
> Fragmented DNS responses happen occasionally with DNSSEC
It is not clear that DNSSEC helps in this case. Given just the text (and my unfamiliarity with DNS protocols on the wire) it seems to imply this occurs because of DNSSEC.
EDIT:
> In the meantime, DNSSEC does actually protect against this vulnerability, but it does require that your domain is signed and that your CA validates. This may not yet be the case.
It is not clear that DNSSEC helps in this case. Given just the text (and my unfamiliarity with DNS protocols on the wire) it seems to imply this occurs because of DNSSEC.
EDIT:
> In the meantime, DNSSEC does actually protect against this vulnerability, but it does require that your domain is signed and that your CA validates. This may not yet be the case.
Nevermind.