Hacker News new | ask | show | jobs
by tszming 3580 days ago
I think most of the providers (e.g. DO, Linode, CloudFlare etc) do not check the authority of DNS due to the chicken-and-egg problem. The AWS way to handle this issue is definitely awesome but the infrastructure required is not worth for those companies who are providing "free DNS service" as an add-on to their existing customers. Anyway, IMO, it is your fault if you point to a nameserver but not utilizing it.
1 comments
jsmthrowaway 3580 days ago
The random nameservers are only accidentally a defense against this attack. They're avoiding SPOFs, including TLDs -- you never receive nameservers in the same TLD for example. It's a reliability and scaling consideration with this accidental benefit.

Most admins don't think about a complete TLD failure. Amazon did.

link
tszming 3580 days ago
>> accidental benefit.

Agree

>> Most admins don't think about a complete TLD failure. Amazon did.

I think companies such as Google or Facebook did think that before, but I am not sure why they didn't follow this trick.

link