[Idea] DNS-based service to determine public IPs

[peter]

Thank you for this great suggestion!

@fiwswe

However they are most likely rather expensive on the server side if they are implemented using the same Python backend as the rest of the web services.

They are not, but are answered directly by nginx: desec-stack/www/conf/sites-available/10-dedyn-checkip.conf.var at main · desec-io/desec-stack · GitHub (look for return)

This is about as cheap as sending a “429 Too Many Requests” response

@fiwswe

I have seen that several large (US) companies seem to offer DNS-based services that do the same thing:

Those are unprotected responses, so a capable attacker could spoof the response, and then cause your update client to make a request to place a malicious record in your domain’s DNS.

@fiwswe

DNSSEC signatures of the returned DNS records? They would probably force the requests to go to the master server

It would not be a big issue to make an exception for that specific query name to be signed on the secondaries.

We already do that for RFC 9615 bootstrapping records, those are signed on the fly on the secondary:

$ dig +short _dsboot.dedyn.io._signal.ns1.desec.io CDS +dnssec
35233 13 4 CE807E76229D64AAE886B2732355BDD68E2C9D1039609085DFE15933 FE031C71981A7FA77F45B22192F76724A9B29FB9
35233 13 2 9C672AE324884F9A0174330CA7644F6960172C1D94023F946F707639 BE6D3AB0

Stay secure,
Peter