Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'd like to validate the ability to own a DNS domain and am already considering validation that is currently in use by others such as

  • Email validation of Whois contacts
  • Access to the "postmaster@domain.com" or "admin@domain.com" email addresses
  • A special CNAME entry that is set to an arbitrary value

Question

  1. Since control of DNS is what I'm targeting, is email validation of the SOA record in a given DNS zone sufficient validation for a domain?

  2. How much confidence should I give to someone who validated their email address from the responsible mail addr in a given DNS SOA record?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

If you send an email to an address that you find in the SOA, you are not, technically, validating control of the domain; you are validating control of that specific email address. Which is not the same thing.

To really validate control of the domain, send a challenge to the purported domain owner: make him create a new entry in the DNS, e.g. a TXT field, or a custom CNAME. If the requested entry appears, then yes, your interlocutor appears to be in control of the domain. As for any challenge/response protocol, the challenge ought to be unpredictable (i.e. the custom CNAME should include a big random name element).

Email addresses in the SOA are not necessarily up-to-date. Most SOA have this address because it is part of the format, but it is rarely verified so I guess that many domain have an incorrect address there, or an address ending in a mailbox which nobody looks at. In any case, I don't think that many people consider that putting this address in the SOA constitutes a delegation of power over the domain to the individual who would happen to be able to read emails sent to that address (especially since emails are not exactly the most protected communication system ever).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.