Measures for Making DNS More Resilient against Forged Answers

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 18
Abstract: The current Internet climate poses serious threats to the Domain Name System. In the interim period before the DNS protocol can be secured more fully, measures can already be taken to harden the DNS to make 'spoofing' a recursing nameserver many orders of magnitude harder. Even a cryptographically secured DNS benefits from having the ability to discard bogus responses quickly, as this potentially saves large amounts of computation. By describing certain behavior that has previously not been standardized, this document sets out how to make the DNS more resilient against accepting incorrect responses. This document updates RFC 2181. [STANDARDS-TRACK]
Publication Date: 2009-01-01
Status Note: Proposed Standard
DOI: 10.17487/RFC5452
Link: https://doi.org/10.17487/RFC5452
Author(s): Bert Hubert
Remco Mook
Keyword(s): Spoofing

Latest version of IETF RFC 5452

Document Versions — IETF RFC 5452

▶ IETF RFC 5452 (2009-01-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 1034 [Active*]
IETF RFC 1035 [Active, Amended*]
IETF RFC 2119 [Active*]
IETF RFC 2181 [Active*]
IETF RFC 2827 [Active*]
IETF RFC 2845 [Superseded*]
IETF RFC 3013 [Active*]
IETF RFC 4033 [Active*]
IETF RFC 4086 [Active*]
IETF RFC 5321 [Active*]

Bibliographic Reference(s)

United States CERT, "Various DNS service implementations generate multiple simultaneous queries for the same resource record", VU 457875, November 2002. EXTERNAL
IETF RFC 1123 [Active*]
IETF RFC 3833 [Active*]
IETF RFC 4301 [Active, Amended*]
RFC4787 — RFC4787 EXTERNAL
IETF RFC 5358 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC5452.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 5452, Measures for Making DNS More Resilient against Forged Answers. Available at https://doi.org/10.17487/RFC5452

Snippet:

IETF RFC 5452, Measures for Making DNS More Resilient against Forged Answers. Available at https://doi.org/10.17487/RFC5452

HTML (ISO 690 compliant)

Preview:

IETF RFC 5452, Measures for Making DNS More Resilient against Forged Answers. Available at https://doi.org/10.17487/RFC5452

Snippet:

<span class="citation"><cite>IETF RFC 5452</cite>, Measures for Making DNS More Resilient against Forged Answers. Available at <a href="https://doi.org/10.17487/RFC5452" target="_blank" rel="noopener">https://doi.org/10.17487/RFC5452</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 5452, Measures for Making DNS More Resilient against Forged Answers
doi: 10.17487/RFC5452
url: https://doi.org/10.17487/RFC5452

Snippet:

<li>
<cite id="bib-rfc5452">IETF RFC 5452</cite>, Measures for Making DNS More Resilient against Forged Answers
<span class="doi">10.17487/RFC5452</span>
</li>

Referenced By

IETF RFC 9210 [Active*]
IETF RFC 9520 [Active*]