<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">In our particular case, we have stale glue records for our name-servers that appear to be coming from a domain we host that is owned by someone else. Despite our best efforts, we have not been able to reach the owners and thus have not been able to get the host records changed at the registrar. The net result is that any domains listing those server names fail to resolve as the old IPs are no longer in service.<div><br></div><div>This raises a scary question. If this is really an undefined situation, could it be used as an attack vector? Although our particular situation involves no component of fraud, what is to stop someone from registering a domain and listing our server name with a bogus IP?</div><div><br></div><div><div><div><div> <span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><div style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Helvetica" size="3" style="font: 12.0px Helvetica">--</font></p><p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Helvetica" size="3" style="font: 12.0px Helvetica"><b style="font-weight: bold; "><span class="Apple-style-span" style="font-weight: bold; ">Milo Hyson</span></b></font></p><p style="margin: 0.0px 0.0px 0.0px 0.0px">Chief Scientist</p><p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Helvetica" size="3" style="font: 12.0px Helvetica">CyberLife Labs</font></p><br class="Apple-interchange-newline"></div></span> </div><br><div><div>On Jan 7, 2009, at 23:57, Doug Barton wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Milo Hyson wrote:<br><blockquote type="cite">If different registrars contain different host records for the same name<br></blockquote><blockquote type="cite">server, what glue records are established in the root servers? Suppose<br></blockquote><blockquote type="cite">two domains at different registrars both list ns1.mydomain.com as a<br></blockquote><blockquote type="cite">nameserver but each gives a different IP. Are the results undefined?<br></blockquote><br>I'm not sure what the theoretically "correct" way for the reg*'s to<br>resolve this is, but in practice you're right, the results are<br>undefined. If these are all hosts and records that you control, the<br>short answer is, "be careful not to do that."<br><br>If you've run into a situation where a hostname for a domain you now<br>control has stale glue your best point of contact is your registrar<br>for com/net/org/info/biz/us.<br><br><br>hth,<br><br>Doug<br><br></div></blockquote></div><br></div></div></div></body></html>