1. watchA/cloudflare/乗取/mixed_response

Contents

watchA/cloudflare/乗取/mixed_response

1.1. 疑わしい返答

正常に委譲されたドメインであれば、2つのNSが同じ返答をする。(しかも、委譲NSに一致する。)

しかし、怪しいものがある。

2つのNSのうちの一方しか返事をしない。返事のNSセットは登録NSとは不一致。(別の特定NS)
- 返事をするNSをふたつ返してくる。
cloudflareの不良というよりは、/elliot/mollyを割当られたひとが乗取を狙ったというのがありそう。

-- ToshinoriMaeno 2019-11-11 03:56:28

brianscottracing.com

brianscottracing.com. 300 IN A 37.1.202.109

MXなし。

1.2. 例

%dig -t ns brianscottracing.com @a.gtld-servers.net                     ~/dnsq/cf11

; <<>> DiG 9.12.1 <<>> -t ns brianscottracing.com @a.gtld-servers.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29514
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 5
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;brianscottracing.com.          IN      NS

;; AUTHORITY SECTION:
brianscottracing.com.   172800  IN      NS      elliot.ns.cloudflare.com.
brianscottracing.com.   172800  IN      NS      lorna.ns.cloudflare.com.

;; ADDITIONAL SECTION:
elliot.ns.cloudflare.com. 172800 IN     A       173.245.59.162
elliot.ns.cloudflare.com. 172800 IN     AAAA    2400:cb00:2049:1::adf5:3ba2
lorna.ns.cloudflare.com. 172800 IN      A       173.245.58.190
lorna.ns.cloudflare.com. 172800 IN      AAAA    2400:cb00:2049:1::adf5:3abe

;; Query time: 54 msec
;; SERVER: 192.5.6.30#53(192.5.6.30)
;; WHEN: Mon Nov 11 12:51:53 JST 2019
;; MSG SIZE  rcvd: 192

1.3. elliotの返事

%dig -t ns brianscottracing.com @elliot.ns.cloudflare.com.              ~/dnsq/cf11

; <<>> DiG 9.12.1 <<>> -t ns brianscottracing.com @elliot.ns.cloudflare.com.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21418
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;brianscottracing.com.          IN      NS

;; ANSWER SECTION:
brianscottracing.com.   86400   IN      NS      elliot.ns.cloudflare.com.
brianscottracing.com.   86400   IN      NS      molly.ns.cloudflare.com.

;; Query time: 7 msec
;; SERVER: 173.245.59.162#53(173.245.59.162)
;; WHEN: Mon Nov 11 12:48:21 JST 2019
;; MSG SIZE  rcvd: 104

12:48f%dig -t ns brianscottracing.com @molly.ns.cloudflare.com.               ~/dnsq/cf11

; <<>> DiG 9.12.1 <<>> -t ns brianscottracing.com @molly.ns.cloudflare.com.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40810
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;brianscottracing.com.          IN      NS

;; ANSWER SECTION:
brianscottracing.com.   86400   IN      NS      elliot.ns.cloudflare.com.
brianscottracing.com.   86400   IN      NS      molly.ns.cloudflare.com.

;; Query time: 6 msec
;; SERVER: 173.245.58.205#53(173.245.58.205)
;; WHEN: Mon Nov 11 12:48:30 JST 2019
;; MSG SIZE  rcvd: 104

1.4. lorna REFUSED

12:48f%dig -t ns brianscottracing.com @lorna.ns.cloudflare.com.               ~/dnsq/cf11

; <<>> DiG 9.12.1 <<>> -t ns brianscottracing.com @lorna.ns.cloudflare.com.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 30673
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;brianscottracing.com.          IN      NS

;; Query time: 7 msec
;; SERVER: 173.245.58.190#53(173.245.58.190)
;; WHEN: Mon Nov 11 12:48:48 JST 2019
;; MSG SIZE  rcvd: 49