<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><br><div>On 8 Oct 2017, at 16:24, Ralph Seichter <<a href="mailto:m16+tor@monksofcool.net">m16+tor@monksofcool.net</a>> wrote:<br><br></div><blockquote type="cite"><div><div preoffsettop="325"><blockquote type="cite" preoffsettop="325"><span>who is aware of the query is not all that matters ; the apparent</span><br></blockquote><blockquote type="cite" preoffsettop="351"><span>origin of the query also matters, depending of the position of the</span><br></blockquote><blockquote type="cite" preoffsettop="377"><span>attacker.</span><br></blockquote></div><span></span><br><span>Sure, but keep in mind: Even if an attacker could gain access to all</span><br><span>root zone servers, he could not see the necessary follow-up queries on</span><br><span>TLD level (e.g. country domains, or .com, .net, etc.) and beyond. If I</span><br><span>looked up <span><a href="http://host.somedomain.fr">host.somedomain.fr</a></span>, a root zone snoop might show my interest</span><br><span>in a French domain, but nothing else.</span></div></blockquote><div><br></div><div>This is only true if your resolver implements QNAME minimisation:</div><div><a href="https://tools.ietf.org/html/rfc7816">https://tools.ietf.org/html/rfc7816</a></div><div><br></div><div><pre class="newpage" style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><blockquote type="cite"><font face="UICTFontTextStyleTallBody"><span style="white-space: normal; background-color: rgba(255, 255, 255, 0);">Currently, when a resolver receives the query "What is the AAAA
record for <a href="http://www.example.com">www.example.com</a>?", it sends to the root (assuming a cold
resolver, whose cache is empty) the very same question. Sending the
full QNAME to the authoritative name server is a tradition, not a
protocol requirement.</span></font></blockquote><br></pre><pre class="newpage" style="margin-top: 0px; margin-bottom: 0px; break-before: page;">Does the version of the recursive resolver you're using</pre><pre class="newpage" style="margin-top: 0px; margin-bottom: 0px; break-before: page;">do this?</pre><pre class="newpage" style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><br></pre><pre class="newpage" style="margin-top: 0px; margin-bottom: 0px; break-before: page;">Or does it send only the minimal name required?</pre><pre class="newpage" style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><br></pre><pre class="newpage" style="margin-top: 0px; margin-bottom: 0px; break-before: page;">T</pre></div></body></html>