Light

Episode #1010 Quiz

DNS Over TLS
Date: 2025-01-28 | Length: 2.25 hrs | Episode page at twit.tv

About this episode

Security Now! #1010 explores DNS over TLS (DoT), detailing its implementation challenges compared to traditional DNS over UDP, notably the overhead of TCP connection and TLS handshake state management on big DNS servers leading to impatient connection drops. Encrypted DNS mitigates privacy risks but requires bursty, amortized queries for performance.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the specific DNS misconfiguration error in Mastercard's DNS servers that persisted for nearly five years?

Question 1

What was the specific DNS misconfiguration error in Mastercard's DNS servers that persisted for nearly five years?

Mastercard's DNS servers had expired certificates causing TLS handshake failures. A nameserver IP address was listed as IPv4 instead of IPv6 causing resolution failures. One of Mastercard's DNS servers was running insecure DNS over UDP instead of DNS over TLS. A nameserver domain was incorrectly listed as "akam.ne" missing the final 't' in ".net".

Question 2: Why do DNS over TLS (DoT) servers tend to drop connections quickly after establishment?

Question 2

Why do DNS over TLS (DoT) servers tend to drop connections quickly after establishment?

Because TLS connections require significant server resources to maintain state, which are costly for busy servers. Due to incompatibility between IPv4 and IPv6 connections causing handshake failures. Because UDP packets carrying DNS queries are more efficient, so TLS is avoided. Because clients typically switch quickly to DNS over HTTPS (DoH), making DoT connections obsolete.

Question 3: How does the typical web browser's DNS query behavior make the performance cost of DNS over TLS feasible?

Question 3

How does the typical web browser's DNS query behavior make the performance cost of DNS over TLS feasible?

Browsers cache all DNS queries for months, reducing the need for frequent resolutions. DNS queries occur in bursts, allowing amortization of expensive connection setup over many queries. DNS queries use a multicast broadcast that is faster despite TLS overhead. Browsers switch to unencrypted DNS for performance-critical queries to avoid overhead.

Question 4: What key limitation did the attacker pose by registering the misnamed "akam.ne" domain for Mastercard's DNS?

Question 4

What key limitation did the attacker pose by registering the misnamed "akam.ne" domain for Mastercard's DNS?

The attacker could intercept about one-fifth of Mastercard's DNS queries and could leverage TTL to affect much more traffic. The attacker prevented Mastercard employees from accessing internal DNS servers by blocking "akam.net" domains. The attacker gained full administrative control over Mastercard's banking systems remotely. The attacker was able to remotely execute malware on Mastercard's servers via the DNS misconfiguration.

Question 5: What was the unexpected discovery made when benchmarking DNS over TLS compared to traditional DNS over UDP?

Question 5

What was the unexpected discovery made when benchmarking DNS over TLS compared to traditional DNS over UDP?

DNS over TLS eliminates all DNS query latency compared to traditional DNS over UDP by using optimized cryptography. DNS over TLS delivers queries and responses in single UDP packets just like traditional DNS. Encrypted DNS servers allow unlimited idle connection time to clients as they have abundant resources. Encrypted DNS requires TCP connections with significant handshake overhead and state that cause server impatience with idle connections.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.