[Dnssec-deployment] "Two Strikes For the I-root"

Paul Wouters paul at xelerance.com
Fri Jun 11 15:25:07 EDT 2010

(I'd be interested to know what the RRSIG's say when querying that instance  -- Paul)

Two Strikes For the I-root
By Earl Zmijewski on June 9, 2010 3:04 PM | 10 Comments | No TrackBacks

Here we go again. In March we wrote a blog entitled Accidentally Importing
Censorship which described how incorrect DNS answers were returned in
response to certain queries to the I-root. The problem was tracked down
to a single instance of the I-root located in China. Queries to this
server for domains blocked in China, such as Facebook, would return
seemingly arbitrary answers. As we noted, countries, and even companies,
can impose their own standards on the Internet and block anything they
want. This story was only noteworthy because those blocks (via bad DNS
answers) became visible outside of China. Well, guess what? We are once
again seeing the Beijing I-root from outside of China.

[ ... ]

Not surprisingly, most of the affected countries are in Asia, as before,
but there are important differences from the last event. Russia, India
and Taiwan all entered the top twelve, while Pakistan, New Zealand
and Bangladesh have dropped out. The impact on the countries in both
lists is roughly similar, except that US impact went up by a factor
of 10. Potentially impacted US states include Florida and California,
making up approximately half of the US total. In addition, Singapore
increased from 73% to 96%.


More information about the Dnssec-deployment mailing list