DNS Flag Day 2020 - renewed effort to avoid IP fragmentation

guest · Oct 1, 2020

DNS Flag Day dawns with renewed effort to avoid IP fragmentation
October 1, 2020
https://portswigger.net/daily-swig/dns-flag-day-dawns-with-renewed-effort-to-avoid-ip-fragmentation

A second round of attempts to encourage laggards to update obsolete Domain Name Server (DNS) infrastructure by dropping support for cumbersome workarounds takes place today (October 1).

The second DNS Flag Day is focused on pushing network administrators towards tighter compliance with established standards for supporting DNS transport over the Transmission Control Protocol (DNS-over-TCP).
Some DNS responses are too big to be handled by the User Datagram Protocol (UDP), resulting in fragmentation of IP packets. Fragmentation presents a well-known security risk, as organizers of the DNS Flag Day 2020 explain.

IP fragmentation is unreliable on the internet today, and can cause transmission failures when large DNS messages are sent via UDP. Even when fragmentation does work, it may not be secure; it is theoretically possible to spoof parts of a fragmented DNS message, without easy detection at the receiving end.
Click to expand...

Securing DNS
DNS Flag Day 2020 involves dropping support for cumbersome workarounds so stragglers need to apply updates to stay in the game.

“The changes should also provide protection against the attacks possible against fragmented DNS, so that’s a security benefit,” he added.
Click to expand...

Flying the flag
The delayed second edition of DNS Flag Day follows its first predecessor, which took place in February 2019.

The underpinning philosophy behind DNS Flag Day is that the ISPs and DNS operators that make up the DNS community should no longer suffer the inconvenience and cost caused by workarounds that only benefit a small number of organizations that are way behind in following network security best practices.
No follow-up DNS Flag Days are scheduled at present.
Click to expand...

DNS flag day 2020 (blog entry)

What’s next?
The next DNS Flag Day is scheduled for 2020-10-01. It focuses on the operational and security problems in DNS caused by Internet Protocol packet fragmentation.

On this page you can find comprehensive description of the problem, technical changes planned for 2020-10-01, and ways to test your systems before the set date.
Click to expand...

reasonablePrivacy · Oct 1, 2020

Interesting read. Thanks.

Log in or Sign up

DNS Flag Day 2020 - renewed effort to avoid IP fragmentation

guest Guest

reasonablePrivacy Registered Member

Log in or Sign up

DNS Flag Day 2020 - renewed effort to avoid IP fragmentation

guest Guest

reasonablePrivacy Registered Member

Useful Searches