You Depend on DNS, This Is How It Works and You Won't...
summary
Live TCPdump demo shows a single hostname resolution produces six lookups (A/AAAA plus search path) and that recursion plus caching is why DNS scales. Cache poisoning gets extra entropy from mixed case using the 0x20 bit case entropy trick, implemented by Google 8.8.8.8 (Cloudflare and Quad9 do not). DNSSEC provides signed chains and KSK ceremonies; NSEC vs NSEC3 tradeoffs affect zone enumeration. Chrome’s omnibox probes caused >50% of root queries in 2020.
AI-written summary · about
chapters (14)
- 0:00Talk overview
- 1:05Live DNS demo
- 2:10Cache misses in resolvers
- 3:11Hosts files to DNS
- 4:37DNS poisoning & randomization
- 6:02DNSSEC introduction & limits
- 7:27DNSSEC key ceremonies
- 8:12Negative results in DNSSEC
- 9:36Adding domains to DNS
- 10:40New country code TLDs
- 11:23Generic TLD expansion & fees
- 11:44Internationalized domain names
- 13:27Chrome’s DNS probes
- 14:53Chrome’s impact on root queries
