Practical Challenge-Response for DNS

Rami Al-Dalky, Michael RabinovichMark Allman

Authoritative DNS servers are susceptible to being leveraged in denial of service attacks in which the attacker sends DNS queries while masquerading as a victim—and hence causing the DNS server to send the responses to the victim. This reflection off innocent DNS servers hides the attackers identity and often allows the attackers to amplify their traffic by employing small requests to elicit large responses. Several challenge-response techniques have been proposed to establish a requester’s identity before sending a full answer. However, none of these are practical in that they do not work in the face of “resolver pools”—or groups of DNS resolvers that work in concert to lookup records in the DNS. In these cases a challenge transmitted to some resolver R1 may be handled by a resolver R2, hence leaving an authoritative DNS server wondering whether R2 is in fact another resolver in the pool or a victim. We offer a practical challenge-response mechanism that uses challenge chains to establish identity in the face of resolver pools. We illustrate that the practical cost of our scheme in terms of added delay is small.

Download the full article


  1. Pingback: 2019 two piece
  2. Pingback: scary maze
  3. Pingback: 바카라사이트
  4. Pingback: dark wiki url
  5. Pingback: penang web design
  6. Pingback: blockchain
  7. Pingback: 필리핀카지노
  8. Pingback: steeze
  9. Pingback: Source
  10. Pingback: PKV GAMES
  11. Pingback: coinlock
  12. Pingback: Istanaimpian2
  13. Pingback: 카지노사이트
  14. Pingback: 바카라사이트

Leave a Reply