laissez-faire DNS

Sat Aug 10 08:03:07 UTC 2002

<all the standard disclaimers>

Those whom I'm speaking to know the security and routing vulnerabilities
associated with name resolution.
(others, some background:
http://citeseer.nj.nec.com/schuba93addressing.html ,
http://citeseer.nj.nec.com/lioy00dns.html)

Anyway, I wish I were providing solutions or even offering new
information. Instead, I'm looking for some insight. It has come to my
attention that some ISPs and most web-hosting companies I've researched
allow their customers to freely configure their forward and reverse DNS
through some sort of interface or ticket submission, neither of which
goes through any sort of validation. This not only poses a serious
security risk to their customers, but to any domain one of their
customers choose to hi-jack. The argument of these companies is "there
is not real validation process available" that "registrars list
disclaimers with their whois information [that it may not be valid]" and
"the hundreds of changes and discrepancies reported [each month] would
cost too much administratively". 

While I see the validity in their arguments, I cannot help but to
shutter at the possible repercussions of giving into such obstacles. Is
it so impossible to implement an authentication process that could be
script automated--at least weeding out all but the most dedicated
poisoner? I've toyed around with a couple solutions I would like some
input from "the inspired" before I attempt to publish anything.

(And, props to Vixie for his work continuous work on Bind and those
engineers collaborating on DNSSEC)

j