1. (An Anti-Abuse Perspective)
DNS Fundamentals
(An Anti-Abuse Perspective)
Carlos Álvarez, IS-SSR Team | Steve Conte , Office of the CTO
18 May 2016

2. Domain Name System 1 Resolution Process 2 Registration Process 3
Internet Identifiers
Structure and Resolution
Resolution Process
Parties Involved
Registration
Whois 2
Registration Process 3
Why all this matters: Anti-Abuse

3. DNS: Internet Identifiers
MAC, IP, Domains

4. SLD – Second Level Domain
DNS: Structure and Resolution
string.tld.
“.”
edu
org
club
biz ar
any
isoc
icann
gacweb
whois
root – “.”
TLD – “.org.”
2nd Level – “icann.org.”
3rd Level – “gacweb.icann.org.”
Top Level Domain
SLD – Second Level Domain 4

5. DNS: Structure and Resolution
string.tld.
m.root-servers.net
a0.org.afilias-nst.info
ns1.icann.org
dns.icann.org 1 2 3 4 5 6 7 8 5

6. DNS: Registration Process
Who does what? 6

7. DNS: Registration Process
<command>
<create>
SRS (market competition) / EPP
Availability check / response
Provision of account information and WHOIS
Registrar receives, adds to own DB, forwards to Registry
Registry adds entry in its zone 7

8. DNS: WHOIS Registration Info Postal address, email, phone, fax
Timestamps, statuses, name servers
Accuracy
Validation, i.e. s in RFC5322, phone numbers in ITU-T E.164, postal addresses in UPU or S42 format template
Verification: Registrant or Account Holder or telephone requiring affirmative response
Contacts: Registrant, Admin Contact, Tech Contact, Billing Contact 8

9. DNS: Why all this matters
Anti-Abuse 9

10. DNS: Why all this matters
Anti-Abuse
Some hot topics regarding abuse of registration services:
Resellers: Identified by Registrar? Responsive?
Privacy/Proxy services: Relay/Reveal
Compliance with RAA abuse provisions: Review and Respond
Suspension/cancellation of malicious domains?
DNS Sinkholing?
Not enough data or false positive?
Domain Generation Algorithms: Automated!
Threats:
Botnet command and control
Malware distribution
Phishing/pharming 10

11. DNS: Why all this matters
Anti-Abuse
Some hot topics regarding abuse of resolution services:
m.root-servers.net
a0.org.afilias-nst.info
ns1.icann.org
dns.icann.org 1 2 3 4 5 6 7 8
DNS Hijacking / Cache Poisoning 11

12. x DNS: Why all this matters
Anti-Abuse
Some hot topics regarding abuse of resolution services: x
DNS Servers (ISPs, own)
Victim
Reflection+Amplification=DDoS 12

13. ICANN
One World. One Internet

14. Engage with ICANN Questions?/
@isitreallysafe
twitter.com/icann
gplus.to/icann
facebook.com/icannorg
weibo.com/ICANNorg
linkedin.com/company/icann
flickr.com/photos/icann
youtube.com/user/icannnews
slideshare.net/icannpresentations