Internetworkers: http://www.ibiblio.org/internetworkers/

["Alan MacHett" <machett AT ibiblio.org>]

I queried a friend of mine who works as a DNS sysadmin for the US House. 
He didn't have much to say on the matter, but I infer that the situation
is high on their priority list.

-Alan


---------------------------- Original Message ----------------------------
Subject: Re: [internetworkers] Verisign screwing with DNS (fwd)
From:    "Scott Ripley" <snip>
Date:    Tue, September 16, 2003 14:55
To:      machett AT ibiblio.org
--------------------------------------------------------------------------

Dude, it's true. Type any name into nslookup and you'll get a response.
Watch:

W # nslookup
Default Server:  tungsten.house.gov
Address:  137.18.255.242

> blahadsfadierf.com
Server:  tungsten.house.gov
Address:  137.18.255.242

Non-authoritative answer:
Name:    blahadsfadierf.com
Address:  64.94.110.11

They've really f'd up a lot of shit with this. I can't believe they didn't
think about the implications. My office-mate and I are working on ways to
block traffic to this server.

Gotta go buy rum and hurricane mix for the upcoming "party."




---
A reminder from the NSA: Do not use words like 'assassinate' and
'president' in your e-mail!


--------- Original Message ---------

DATE: Tue, 16 Sep 2003 12:45:28
From: machett AT ibiblio.org
To: snip
Cc:

>
>Scott,

>

>Got any info on this?

>

>-Alan

>

>On Tue, 16 Sep 2003 11:07:25 -0400,  said:

>>I tried this today and almost any name you can makeup is resolving

>>now...eek.

>>

>>

>>This is excerpted from Trilug...

>>

>>An item of general interest.

>>

>>I'm told that Verisign has inserted a wildcard DNS record into the .com

>>and .net TLDs, with the effect that a query on an unregistered domain

>>name now resolves to a specific IP address.  This hasn't manifested

>>itself here yet, but I guess it will over the next day or so.

>>

>>One of the side-effects is that any attempt to block email by checking

>>that the sender's domain exists, will now fail.  Another side-effect

>>concerns mis-configured mail servers or DNS entries: if you are

>>configuring a mail relay and/or put a typo in the MX record, you may get

>>unexpected results since the IP address indicated by Verisign happens to

>>be running an SMTP server.

>>

>>I'll refrain from repeating the outraged comments on various discussion

>>groups.  It will be interesting to see how this situation evolves.

>>

>>Regards,

>>

>>

>>

>>---