## page was renamed from ccTLD/cz/NXDomain == ccTLD/cz/NXDomain == NXDomain response means more than "no such name". SOA says closest zone cut above the query and not above the domain that queried server controls. ---- $ dnsq ns cz a.ns.nic.cz {{{ 2 cz: 91 bytes, 1+4+0+0 records, response, authoritative, noerror query: 2 cz answer: cz 18000 NS b.ns.nic.cz answer: cz 18000 NS a.ns.nic.cz answer: cz 18000 NS c.ns.nic.cz answer: cz 18000 NS d.ns.nic.cz }}} == poisoning attack == Reply from the cz Authoritative Server is NXDomain for xxxx.a.ns.nic.cz query. $ dnsq a xxxx.a.ns.nic.cz a.ns.nic.cz {{{ 1 xxxx.a.ns.nic.cz: 81 bytes, 1+0+1+0 records, response, authoritative, nxdomain query: 1 xxxx.a.ns.nic.cz authority: nic.cz 1800 SOA a.ns.nic.cz hostmaster.nic.cz 1459343598 10800 3600 1209600 7200 }}} == SOA == This SOA means that there is nic.cz zone,（NS a.ns.nic.cz etc.） but ns.nic.cz, a.ns.nic.cz are not zone. Only the zone cut exists above ns.nic. No zone cut above includign xxxx.a.ns.nic.cz under nic.cz. == defence for Kaminsky - Mueller style poisoning == {{{ So if we get the reply that delegates ns.nic.cz to some host, we can throw it away as poison. }}} Same for a.ns.nic.cz domain name. -- ToshinoriMaeno <> == nic.cz NS == $ dnsq ns nic.cz a.ns.nic.cz {{{ 2 nic.cz: 207 bytes, 1+3+0+6 records, response, authoritative, noerror query: 2 nic.cz answer: nic.cz 1800 NS a.ns.nic.cz answer: nic.cz 1800 NS b.ns.nic.cz answer: nic.cz 1800 NS d.ns.nic.cz additional: a.ns.nic.cz 1800 A 194.0.12.1 additional: b.ns.nic.cz 1800 A 194.0.13.1 additional: d.ns.nic.cz 1800 A 193.29.206.1 additional: a.ns.nic.cz 1800 28 \040\001\006x\000\017\000\000\000\000\000\000\000\000\000\001 additional: b.ns.nic.cz 1800 28 \040\001\006x\000\020\000\000\000\000\000\000\000\000\000\001 additional: d.ns.nic.cz 1800 28 \040\001\006x\000\001\000\000\000\000\000\000\000\000\000\001 }}} == zone cuts == query name minimisation / Knot resolver query example and log {{{ ... }}} -- ToshinoriMaeno <>