The hottest DNS Substack posts right now

DNS management in AWS is now even easier with the release of AWS CDK Split Horizon DNS v0.0.9.
You can import existing hosted zones into the SplitHorizonDns construct without recreating records.
A new safeguard called `disallowPrivateZone` has been added to allow isolation of private zone resources.

Unsolicited DNS queries often don't pose a threat, with approximately 66% of queries being spoofed.
IPv6 traffic is significantly lower than IPv4, making it less interesting to explore further.
Dataplane.org is transitioning towards not-for-profit status and inviting members to a Slack workspace for communication.

False negative results can be a risk if one DNS cache is patched but another is not, impacting the safety of clients.
A NAT device can unintentionally protect vulnerabilities in DNS caches by causing randomization issues, affecting security tool results.
Simple command line tools may offer more accurate DNS analysis results compared to potentially misleading specialized software, benefiting both regular users and sysadmins.

Dan Kaminsky's research revealed DNS tricks like the 'CNiping' CNAME override, showing ways to manipulate cached data in DNS resolvers.
Understanding the probability formula involving 'D', 'R', 'W', 'N', 'P', and 'I' can help in launching successful spoofing attacks on resolvers.
Increasing 'R' and 'A' with specific values like 300 packets/s and 4000 queries can lead to a 51% success chance in poisoning target resolvers, showcasing the relative ease of the attack.

A critical security vulnerability in DNS systems poses a serious threat to stealing online information and controlling internet activities.
DNS, or Domain Name System, is crucial in mapping computer addresses to human-readable names on the internet.
Temporary solution to mitigate the risk includes switching to DNS servers like OpenDNS, which have already fixed the vulnerability.

Get a weekly roundup of the best Substack posts, by hacker news affinity: