{"id":4722,"date":"2009-11-19T16:58:35","date_gmt":"2009-11-20T00:58:35","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=4722"},"modified":"2020-05-06T10:31:47","modified_gmt":"2020-05-06T17:31:47","slug":"giving-thanks-for-good-news-in-dns","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/","title":{"rendered":"Giving Thanks for Good News in DNS"},"content":{"rendered":"

Most of\u00a0the results of our recent DNS Survey<\/a>\u00a0were pretty scary, especially the news that nearly 80% of the name servers we found in our sweep of 5% of the Internet’s address space were open to recursion. But the results contained some good news, too, and for that we should be thankful.<\/p>\n

– Of those open recursors we found, almost 90% used\u00a0source-port randomization<\/a>, the most common mechanism used to combat\u00a0cache poisoning<\/a>\u00a0in general, and\u00a0the Kaminsky vulnerability<\/a>\u00a0in particular. Last year we found that a hair less than 24% of the open recursors we identified exhibited poor source-port randomization (e.g., none), and my friend Matt Larson’s study from the vantage point of the root name servers estimated that roughly 30% hadn’t been patched. Any decrease in the population of name servers vulnerable to cache poisoning is good news.<\/p>\n

– The percentage of zones with name servers open to zone transfers dropped by almost half, from 31% last year to 16% this year. While not as serious a threat as open recursive name servers, name servers that are open to zone transfers are sometimes at risk of denial of service attacks.<\/p>\n

– The percentage of name servers we fingerprinted as running some version of the Microsoft DNS Server dropped to 0.37% from 2.74% just two years ago. That’s really remarkable, given how pervasive the use of Windows operating systems is. This suggests that administrators realize that the Microsoft DNS Server, while useful “behind the firewall,” lacks features necessary to secure it when directly exposed to the Internet.<\/p>\n

– The number of signed subzones of com, net, and org is increasing. In percentage terms, the rise is dramatic: about 270%. But in absolute terms, the increase is much less impressive, from 45 signed subzones last year to 167 this year. Still, that’s heartening evidence of broader deployment of DNSSEC. With the\u00a0.org zone recently signed<\/a>\u00a0and\u00a0.net due to be signed next year<\/a>, as well as the availability of\u00a0products that make the management of DNSSEC-signed zones easier<\/a>, I’ll bet that we’ll see adoption accelerate by next year’s survey. (I’m also grateful to\u00a0the Public Interest Registry<\/a>\u00a0for agreeing to participate in this year’s survey, and to\u00a0VeriSign<\/a>\u00a0for their continued participation.)<\/p>\n

I’m even hopeful that our alarming percentage of open recursors can and will be addressed quickly. If these open recursors are, in fact, customer premises equipment that carriers are deploying, there’s a good chance that those carriers have some kind of centralized control of those devices, or at the very least can change the default configuration the devices ship with. And there’s every reason to believe that the carriers want to do the right thing – after all, who would risk finding coal in his stocking?<\/p>\n","protected":false},"excerpt":{"rendered":"

Most of\u00a0the results of our recent DNS Survey\u00a0were pretty scary, especially the news that nearly 80% of the name servers we found in our sweep of 5% of the Internet’s address space were open to recursion. But the results contained some good news, too, and for that we should be thankful. – Of those open […]<\/p>\n","protected":false},"author":178,"featured_media":2891,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[2],"tags":[30,229,16,15],"class_list":{"0":"post-4722","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security","8":"tag-dns","9":"tag-dnssec","10":"tag-infoblox","11":"tag-security","12":"entry"},"acf":[],"yoast_head":"\nGiving Thanks for Good News in DNS<\/title>\n<meta name=\"description\" content=\"Most of the results of our recent DNS Survey were pretty scary, especially the news that nearly 80% of the name servers we found in our sweep of 5% of the Internet's address space were open to recursion.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Giving Thanks for Good News in DNS\" \/>\n<meta property=\"og:description\" content=\"Most of the results of our recent DNS Survey were pretty scary, especially the news that nearly 80% of the name servers we found in our sweep of 5% of the Internet's address space were open to recursion.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/\" \/>\n<meta property=\"og:site_name\" content=\"Infoblox Blog\" \/>\n<meta property=\"article:published_time\" content=\"2009-11-20T00:58:35+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-05-06T17:31:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/482461333.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2061\" \/>\n\t<meta property=\"og:image:height\" content=\"1457\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Cricket Liu\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Cricket Liu\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/giving-thanks-for-good-news-in-dns\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/giving-thanks-for-good-news-in-dns\\\/\"},\"author\":{\"name\":\"Cricket Liu\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/bb6b62b1b99a7cbcd7c528d5763778d5\"},\"headline\":\"Giving Thanks for Good News in DNS\",\"datePublished\":\"2009-11-20T00:58:35+00:00\",\"dateModified\":\"2020-05-06T17:31:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/giving-thanks-for-good-news-in-dns\\\/\"},\"wordCount\":468,\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/giving-thanks-for-good-news-in-dns\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/482461333.jpg\",\"keywords\":[\"DNS\",\"DNSSEC\",\"Infoblox\",\"Security\"],\"articleSection\":[\"Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/giving-thanks-for-good-news-in-dns\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/giving-thanks-for-good-news-in-dns\\\/\",\"name\":\"Giving Thanks for Good News in DNS\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/giving-thanks-for-good-news-in-dns\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/giving-thanks-for-good-news-in-dns\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/482461333.jpg\",\"datePublished\":\"2009-11-20T00:58:35+00:00\",\"dateModified\":\"2020-05-06T17:31:47+00:00\",\"description\":\"Most of the results of our recent DNS Survey were pretty scary, especially the news that nearly 80% of the name servers we found in our sweep of 5% of the Internet's address space were open to recursion.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/giving-thanks-for-good-news-in-dns\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/giving-thanks-for-good-news-in-dns\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/giving-thanks-for-good-news-in-dns\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/482461333.jpg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/482461333.jpg\",\"width\":2061,\"height\":1457,\"caption\":\"STIX, TAXII and CISA \u00e4\u00f3\u0144 The Age of Info Sharing, Time & Cost Savings, and Government Involvement\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/giving-thanks-for-good-news-in-dns\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/category\\\/security\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Giving Thanks for Good News in DNS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"name\":\"infoblox.com\\\/blog\\\/\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\",\"name\":\"Infoblox\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"width\":137,\"height\":30,\"caption\":\"Infoblox\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/bb6b62b1b99a7cbcd7c528d5763778d5\",\"name\":\"Cricket Liu\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/cricket-new-96x96.jpg\",\"url\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/cricket-new-96x96.jpg\",\"contentUrl\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/cricket-new-96x96.jpg\",\"caption\":\"Cricket Liu\"},\"description\":\"Cricket is one of the world\u2019s leading experts on the Domain Name System (DNS) and serves as the liaison between Infoblox and the DNS community. Before joining Infoblox, he founded an internet consulting and training company, Acme Byte & Wire, after running the hp.com domain at Hewlett-Packard. Cricket is a prolific speaker and author, having written a number of books including \u201cDNS and BIND,\u201d one of the most widely used references in the field, now in its fifth edition.\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/author\\\/cricket-liu\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Giving Thanks for Good News in DNS","description":"Most of the results of our recent DNS Survey were pretty scary, especially the news that nearly 80% of the name servers we found in our sweep of 5% of the Internet's address space were open to recursion.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/","og_locale":"en_US","og_type":"article","og_title":"Giving Thanks for Good News in DNS","og_description":"Most of the results of our recent DNS Survey were pretty scary, especially the news that nearly 80% of the name servers we found in our sweep of 5% of the Internet's address space were open to recursion.","og_url":"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/","og_site_name":"Infoblox Blog","article_published_time":"2009-11-20T00:58:35+00:00","article_modified_time":"2020-05-06T17:31:47+00:00","og_image":[{"width":2061,"height":1457,"url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/482461333.jpg","type":"image\/jpeg"}],"author":"Cricket Liu","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Cricket Liu","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/#article","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/"},"author":{"name":"Cricket Liu","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/bb6b62b1b99a7cbcd7c528d5763778d5"},"headline":"Giving Thanks for Good News in DNS","datePublished":"2009-11-20T00:58:35+00:00","dateModified":"2020-05-06T17:31:47+00:00","mainEntityOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/"},"wordCount":468,"publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/482461333.jpg","keywords":["DNS","DNSSEC","Infoblox","Security"],"articleSection":["Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/","url":"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/","name":"Giving Thanks for Good News in DNS","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/#primaryimage"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/482461333.jpg","datePublished":"2009-11-20T00:58:35+00:00","dateModified":"2020-05-06T17:31:47+00:00","description":"Most of the results of our recent DNS Survey were pretty scary, especially the news that nearly 80% of the name servers we found in our sweep of 5% of the Internet's address space were open to recursion.","breadcrumb":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/#primaryimage","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/482461333.jpg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/482461333.jpg","width":2061,"height":1457,"caption":"STIX, TAXII and CISA \u00e4\u00f3\u0144 The Age of Info Sharing, Time & Cost Savings, and Government Involvement"},{"@type":"BreadcrumbList","@id":"https:\/\/www.infoblox.com\/blog\/security\/giving-thanks-for-good-news-in-dns\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.infoblox.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Security","item":"https:\/\/www.infoblox.com\/blog\/category\/security\/"},{"@type":"ListItem","position":3,"name":"Giving Thanks for Good News in DNS"}]},{"@type":"WebSite","@id":"https:\/\/www.infoblox.com\/blog\/#website","url":"https:\/\/www.infoblox.com\/blog\/","name":"infoblox.com\/blog\/","description":"","publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.infoblox.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.infoblox.com\/blog\/#organization","name":"Infoblox","url":"https:\/\/www.infoblox.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","width":137,"height":30,"caption":"Infoblox"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/bb6b62b1b99a7cbcd7c528d5763778d5","name":"Cricket Liu","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/cricket-new-96x96.jpg","url":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/cricket-new-96x96.jpg","contentUrl":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/cricket-new-96x96.jpg","caption":"Cricket Liu"},"description":"Cricket is one of the world\u2019s leading experts on the Domain Name System (DNS) and serves as the liaison between Infoblox and the DNS community. Before joining Infoblox, he founded an internet consulting and training company, Acme Byte & Wire, after running the hp.com domain at Hewlett-Packard. Cricket is a prolific speaker and author, having written a number of books including \u201cDNS and BIND,\u201d one of the most widely used references in the field, now in its fifth edition.","url":"https:\/\/www.infoblox.com\/blog\/author\/cricket-liu\/"}]}},"_links":{"self":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/4722","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/users\/178"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/comments?post=4722"}],"version-history":[{"count":1,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/4722\/revisions"}],"predecessor-version":[{"id":4723,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/4722\/revisions\/4723"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media\/2891"}],"wp:attachment":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media?parent=4722"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/categories?post=4722"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/tags?post=4722"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}