1. ccTLD/cz/NXDomain

NXDomain response means more than "no such name".

• SOA says closest zone cut above the query and not above the domain that queried server controls.

---

$ dnsq ns cz a.ns.nic.cz

2 cz:
91 bytes, 1+4+0+0 records, response, authoritative, noerror
query: 2 cz
answer: cz 18000 NS b.ns.nic.cz
answer: cz 18000 NS a.ns.nic.cz
answer: cz 18000 NS c.ns.nic.cz
answer: cz 18000 NS d.ns.nic.cz

2. poisoning attack

Reply from the cz Authoritative Server is NXDomain for xxxx.a.ns.nic.cz query.

$ dnsq a xxxx.a.ns.nic.cz a.ns.nic.cz

1 xxxx.a.ns.nic.cz:
81 bytes, 1+0+1+0 records, response, authoritative, nxdomain
query: 1 xxxx.a.ns.nic.cz
authority: nic.cz 1800 SOA a.ns.nic.cz hostmaster.nic.cz 1459343598 10800 3600 1209600 7200

3. SOA

This SOA means that there is nic.cz zone,（NS a.ns.nic.cz etc.）

• but ns.nic.cz, a.ns.nic.cz are not zone.

Only the zone cut exists above ns.nic. No zone cut above includign xxxx.a.ns.nic.cz under nic.cz.

4. defence for Kaminsky - Mueller style poisoning

So if we get the reply that delegates ns.nic.cz to some host,
we can throw it away as poison.

Same for a.ns.nic.cz domain name.

-- ToshinoriMaeno 2016-03-31 05:10:25

5. nic.cz NS

$ dnsq ns nic.cz a.ns.nic.cz

2 nic.cz:
207 bytes, 1+3+0+6 records, response, authoritative, noerror
query: 2 nic.cz
answer: nic.cz 1800 NS a.ns.nic.cz
answer: nic.cz 1800 NS b.ns.nic.cz
answer: nic.cz 1800 NS d.ns.nic.cz
additional: a.ns.nic.cz 1800 A 194.0.12.1
additional: b.ns.nic.cz 1800 A 194.0.13.1
additional: d.ns.nic.cz 1800 A 193.29.206.1
additional: a.ns.nic.cz 1800 28 \040\001\006x\000\017\000\000\000\000\000\000\000\000\000\001
additional: b.ns.nic.cz 1800 28 \040\001\006x\000\020\000\000\000\000\000\000\000\000\000\001
additional: d.ns.nic.cz 1800 28 \040\001\006x\000\001\000\000\000\000\000\000\000\000\000\001

6. zone cuts

query name minimisation / Knot resolver query example and log

...

-- ToshinoriMaeno 2016-03-31 05:17:28