Speaker
Casey Deccio
(Brigham Young University)
Description
The Domain Name System (DNS) Security Extensions (DNSSEC) introduced additional DNS records (NSEC or NSEC3 records) into negative DNS responses, which records can prove there is no translation for a queried domain name. We introduce a novel technique to estimate the size of a DNS zone by analyzing the NSEC3 records returned by only a small number of DNS queries issued. We survey the prevalence of the deployment of different variants of DNSSEC negative responses across a large set of DNSSEC-signed zones in the wild, and identify over 50% as applicable to our measurement technique. Of the applicable zones, we show that 99% are composed of fewer than 40 names.
| Talk Duration | Lightning Talk 10 Minutes |
|---|
Primary authors
Casey Deccio
(Brigham Young University)
Mr
Jonathan Demke
(Brigham Young University)
