Verisign Countermeasures

For information about what is wrong with Verisign's actions, see this page. For a list of technical problems that have been/could be caused by Verisign, see this

ICANN take (some sort of) action

• new Official Postfix patches at http://www.postfix.org/download.html, filename postfix-2.0-ns-mx-acl-patch.gz
• Yet more ISC BIND patches. The recommended config setting is now root-delegation-only exclude { "org"; "de"; "lv"; "museum"; };:
  • 9.1.3-P3 tarball, announcement
  • 9.2.2-P3 tarball, announcement
  • 9.2.3rc4 tarball, announcement
• ISC Bind patches (it's in Rawhide for RedHat users with version 9.2.2-23). Rob Brown has also made RPMS. Debian packages are here. More RPMS (for RedHat 7.3 and above) by Brian Bruns are here
• Instructions for reconfiguring BIND 8.3.4 to ignore the bad gTLD server are here
• And for BIND 8.4.1 there is a patch here and another one (more general) here

Note for BIND users: The /. patch is reported to make all lookups very slow. The phirate patch is reported to crash BIND in some cases and the ISC patch causes NS lookups for non-cached domains to fail with NXDOMAIN - expect another version soon.

• updated And a djbdns patch here. And here is a Gentoo build for that.
• A patch for the Mailtraq email server
• A patch for PowerDNS
• An LD_PRELOAD able library for Linux is here
• A sendmail ruleset is here.
• Another sendmail ruleset that doesn't hard code the IP addresses into the main config (from Philip Kizer. Add to the config with HACK(check_nxdomain)).
• An Exim ACL condition here
• And another change to the Exim 4 config
• A new release of Simple DNS Plus now has the ability to translate given IP addresses to NXDOMAIN
• DNSMasq 1.15 has added a --bogus-nxdomain option which will filter Verisign wildcards.

If anyone has any other URLs that should be in the list above, please email them to me.

The start of a list of wildcard ips:

Here is a script to automatically generate a list like the table above

Aaron Swartz has written a more comprehensive find-all-wildcards script:

for dom in `curl -s ftp://ftp.internic.net/domain/root.zone.gz | gunzip -c | grep NS | awk '{print $1}' | uniq | egrep "^[^\.]*\.$"`; do
	Y=`dnsip "*.$dom"`
	if [ "$Y" ]; then echo $dom $Y; fi
done

An if you don't have dnsip (it's a part of djbdns) Rob Brown has rewritten the above to use dig

curl -s ftp://ftp.internic.net/domain/root.zone.gz | gunzip -c | grep NS | awk '{print $1}' | uniq | egrep '^[^\.]+\.' | xargs -i dig _.{} | perl -n -e 'print if s/^_\.(\w+)\..*\s([\d\.]+)$/$1 $2/;'

Another script to find wildcard domains

Marc Boucher has contributed a variation on the above scripts to get all information for the hostname: A, CNAME and MX records.