DNS Cache poisioning examples, or other criteria when a client ignores a response

Question

Is there a concise set of rules that describe what 99% percent of DNS responders accept?

Conversely, are there are set of rules that define when DNS queries are invalid?

I would think that the answer I'm looking for is like this:

If the DNS server encounters a FQDN that is not equal to the current traversal location, then it must discard any additional records that are sent in the query, and traverse the DNS hierarchy from the root.

Answer 1

I imagine there's a pretty big difference between what does happen and what should happen. Also, there's a decent amount of inconsistency in this behavior which depends (at least theoretically) on whether or not the server thinks it's supposed to be doing recursive queries.

The "Additional Information" section is there to prevent (otherwise inevitable) additional lookups, thus reducing both the total lookup time and also the strain on the DNS server.

The "rule" as has been largely accepted by the community divides servers into two groups: "authoritative nameservers" and "resolving nameservers". That is, either a DNS server is used to serve a specific set of domains, or it is used to act as a proxy doing recursive DNS lookups to other servers on behalf of a client.

For authoritative nameservers, the following rules apply:

1. Do not return any records for which the server is not the authority
2. (Corollary) Do not do recursive lookups (which would violate rule 1)
3. Do not cache anything (which, of course, would be completely unnecessary anyway if rules 1 and 2 are being followed; which is kind of the point)

For resolving nameservers, the following rules apply:

1. Do not cache or return any records which you did not specifically request (or would have requested from that specific server)
2. Do not cache or return any records which came from a source that is not authoritative for that domain (doing 2 probably implies 1, which again is the point)

The end result is that domains will only come from either authoritative nameservers, or from resolving servers which directly requested the information from authoritative nameservers. This, by definition, means that cache poisoning is not happening.

You'll get additional information from a nameserver when it thinks it has additional information that might help you. If you're questing from an authoritative nameserver, your additional information should be limited to only what's stored on the server. That may mean that if your response is a CNAME to a foreign domain then all you get is a list of the root servers. But if the server has the correct answer for you (such as when the canonical name is within the same zone as the CNAME record), then you should get the most specific information available.

If, on the other hand, you're making requests to a caching resolver, then the server will server will often make additional requests so that the answer you get is something you can use. This is particularly true in the case of CNAME records, but may apply in other cases too.