Home / server / Questions / 759934
Accepted
hooby3dfx
Asked: 2016-02-26 20:07:59 +0800 CST

Can DNS response answers be in a different case than the query?

  • 772

Example (1) of an expected DNS lookup result:

nslookup google.com
Server:  192.168.1.1
Address: 192.168.1.1#53

Non-authoritative answer:
Name: google.com
Address: 173.194.123.41
Name: google.com
Address: 173.194.123.33
...

Example (2) of what I am asking is valid or not:

nslookup google.com
Server:  192.168.1.1
Address: 192.168.1.1#53

Non-authoritative answer:
Name: google.coM
Address: 173.194.123.33
Name: google.coM
Address: 173.194.123.34
...

Note the last letter M in the second example. This was noticed recently on a network with Verizon Fios Quantum.

Does the DNS spec says its acceptable to get a response different than what you request? I know DNS is case insensitive in the respect that if you type in www.GooGLe.cOM you will get the same IP address as www.google.com, but I would think in both of these cases the response should/must match the query exactly.

domain-name-system

1 Answers

  1. Best Answer

    In your case, it is likely that a resolver is adding 0x20 encoding to your request, and this encoding is being cached and served locally contrary to common practice:

    ###While the use of mixed case is allowed in DNS, and leveraged by the IETF draft, "Use of Bit 0x20 in DNS Labels to Improve Transaction Identity" as a DNS forgery/poisoning mitigation technique, it is not enforced by the DNS specification - a server is not obligated to return the exact character encoding, albeit rare; this is a potential issue discussed within the draft.###

    Because all** DNS implementations copy the request exactly into the response (in practice), a request for a domain in mixed-case is returned as such. A client can randomize the character case, and compare the response by the server, which should match:

    (Section 2.2) For example, the following question names will be treated as equal by a responder, but can be treated as unequal by a requestor:

    www.ietf.org
WwW.iEtF.oRg
wWw.IeTf.OrG
WWW.IETF.ORG

    An attacker would need to successfully guess the random encoding or the client will ignore it. As the strength of the encoding is related to the length of the domain name, a longer domain provides greater security - more characters, more entropy.

    It is possible with a non-0x20 implemented client (and after eliminating the likelihood of a middleman introducing encoding,) that a response returned with encoding not in the original request -could- be the result of a poisoning attempt.

    • 3