That is a good thing. No need to take down a malicious domain name, just like malware, add it to a blacklist (Google's Chrome already does this).

The whole point of DNS is that we don't have to pass lists of domain names around, like we did before DNS.

Erm, one is a lookup table for arbitrary (and unknown) names, the other is a blacklist. These are two very different things (the latter is perfectly practical and manageable).

But why wouldn't a blacklist of people trying to game the system be unmanageably huge?

> But why wouldn't a blacklist of people trying to game the system be unmanageably huge?

First, you don't have to leave every entry on the list until the end of time. At some point (possibly as a result of the domain being on the blacklist) the attacker is going to discontinue using it and it could then be removed. Second, you don't have to store the blacklist on every client device.

You could even just integrate it with the DNS. If you want to know if foo.com is on the blacklist, you do a lookup for foo.com.blacklist.google.com and if that resolves then it's blacklisted. If you don't trust Google to maintain the blacklist then you change a setting and your computer looks up foo.com.blacklist.microsoft.com or foo.com.blacklist.spamhaus.org or whatever else instead.

The point is to decentralize the decision of who maintains the blacklist, so that users can stop using a blacklist if its maintainer makes unpopular decisions.

It could be "unmanageably huge" for clients, just like the blockchain itself is unmanageably huge for clients. This is the reason DNSChain is designed the way it is (having a personal, dedicated server to store the blockchain for "groups of friends"), thus allowing many client devices to send it arbitrary queries.

Perfect use case for a Bloom filter.

No need for a blacklist either, I don't believe there's been a single example of a malware using a purely DNS based C&C (e.g by utilizing TXT records) instead of using DNS to get the IP address for the C&C server.

Of course there's always an exception, in this case there exists DNS beacons included in pentesting suite Cobalt Strike, but that doesn't seem to be something widely used.

But is that a good thing? Being "unable to take down malicious domains"? I don't know. There is a part of me that wants to protect against this ability to take down domains - and another part of me that says if there were domains spewing malware and facilitating botnets I'd like to see them taken down somehow.