Starting in Bind 9.2.2P1, there is a new type of zone called delegation-only. It’s designed to counter wild-card records in TLD‘s, such as *.com. This is sometimes called the “Verisign patch” because, while Verisign was not the first TLD operator to create such a wild-card record, their creation of *.com and the SiteFinder service are what prompted ISC to add this new feature to the Bind name server.
what this means is that a site with a wildcard inti can be effectively shutdown.
you add something like the following to named.conf
zone "." { type delegation-only; };
zone "ac" { type delegation-only; };
zone "cc" { type delegation-only; };
zone "com" { type delegation-only; };
zone "cx" { type delegation-only; };
zone "mp" { type delegation-only; };
zone "museum" { type delegation-only; };
zone "net" { type delegation-only; };
zone "nu" { type delegation-only; };
zone "ph" { type delegation-only; };
zone "pw" { type delegation-only; };
zone "sh" { type delegation-only; };
zone "td" { type delegation-only; };
zone "tk" { type delegation-only; };
zone "tm" { type delegation-only; };
zone "ws" { type delegation-only; };
before – a random lookup for a non existent host.domain provides a legitimate IP address when it should have been NXDOMAIN
$ dig wwpfowerewrewr234dsew-0.sitefinder.com ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.2.rc1.fc15 <<>> wwpfowerewrewr234dsew-0.sitefinder.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER< ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ;wwpfowerewrewr234dsew-0.sitefinder.com. IN A ;; ANSWER SECTION: wwpfowerewrewr234dsew-0.sitefinder.com. 3600 IN A 208.73.210.29 ;; AUTHORITY SECTION: sitefinder.com. 172791 IN NS ns2.dsredirection.com. sitefinder.com. 172791 IN NS ns1.dsredirection.com. ;; ADDITIONAL SECTION: ns1.dsredirection.com. 172791 IN A 204.13.160.145 ns2.dsredirection.com. 172791 IN A 204.13.161.145 ;; Query time: 1088 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Fri Apr 6 23:52:54 2012 ;; MSG SIZE rcvd: 154
After – the same query returns NXDOMAIN
$ dig wwpfowerewrewr234dsew-0.sitefinder.com ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.2.rc1.fc15 <<>> wwpfowerewrewr234dsew-0.sitefinder.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 56632 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;wwpfowerewrewr234dsew-0.sitefinder.com. IN A ;; Query time: 1768 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Fri Apr 6 23:5
As a test, I also added
zone "sitefinder.com" { type delegation-only; };
This effectively black-holes the sitefinder.com domain.