There’s a paper from 2013 outlining a fragmentation attack on DNS that allows an off-path attacker to poison certain DNS results using IP fragmentation . I’ve been thinking about mitigation techniques and I’m interested in hearing what this group thinks. To paraphrase the attack: Find an authoritati…

Mitigating DNS fragmentation attack

cpu November 20, 2018, 4:24pm 9

Update: We have implemented the mitigation @jsha described: EDNS Buffer Size Changing to 512 Bytes

3 Likes

Topic		Replies	Views
EDNS Buffer Size Changing to 512 Bytes (In 2024: now 1232) API Announcements	2	6821	July 8, 2024
Ability to Debug what IP address the request is resolved to Feature Requests	15	3368	August 9, 2018
What prevents a state actor with access to your IP from issuing false LetsEncrypt certificates? Issuance Tech	36	286	September 12, 2024
What DNS servers are used for the HTTP challenge Help	4	102	October 31, 2024
DNS challenge questions Help	13	355	June 20, 2024