Speaker
Description
Summary
However, while looking at a large population of resolvers we sometimes get inconsistent results. As best we can determine, these results are at least sometimes a function of differences in the configuration of individual DNS resolvers in an anycast cloud. We may also have probed test configurations that responded in a non-standard way, or perhaps probed misconfigured DNS resolvers.
The test suite is called DNSSEC_resolver_check and is implemented as an application and a browser applet. As our main interest was in determining the state of DNSSEC deployment, we saw an opportunity to attempt to classify the capabilities of open resolvers. We designed a test that both searched for open resolvers and gave us insight into how different organizations set up their DNS resolution, as most of the open "resolvers" are simple forwarders. During this test we attempted to gather more information about the systems that react or respond to DNS queries using both version queries and DNS fingerprinting. A side effect of this test was that we were able to determine whether the targets of forwarding validate or not.
