Protocols, security incidents, and how the internet actually works. 147 posts.
No password was stolen and the registrar record never changed. Yet tens of thousands of domains were taken over — because they pointed their DNS at a provider that would hand the zone to anyone who asked.
Why do about 60% of .nl domains sign with DNSSEC and only about 4% of .com? Not the protocol. Follow the money: adoption tracks which registries pay registrars to sign.
To find example.com you have to ask its nameserver — which lives inside example.com. That's a circular dependency at the root of every domain, and the fix is a small, fragile hack called a glue record that most people never see until it breaks.
DNS makes you know a name before you can ask about it — you can't list a zone. Except there's one operation that lists the whole thing, AXFR, and when it's left open a stranger can ask a nameserver to mail them the phone book.
On February 1, 2019, DNS resolvers agreed to stop working around broken servers. The workaround had been quietly running for two decades.
The trailing dot is the most technically correct way to write a domain name — it spells out the DNS root. Every layer above DNS disagrees about what it means, and those disagreements keep turning into security bugs.
A national firewall doesn't block a censored DNS lookup — it answers it, with a forged reply that wins a race against the truth. Sometimes the lie points at a real company's server, and sometimes it leaks to people the censor never meant to reach.
For eight years the security of signed DNS hung from a single key that had never once changed. When they finally rolled it in 2018, the terrifying part wasn't the cryptography — it was that nobody could see which resolvers were ready to follow.
DNS has no memory — every answer overwrites the last. Passive DNS is the accidental surveillance database that remembers every answer the internet ever gave, going back years, without ever recording who asked.
In 2008 a single researcher found a way to forge any domain on the internet in seconds. The fix wasn't a new protocol — it was 16 bits of randomness bolted onto a 25-year-old design, and we're still leaning on it.
In 2016 a botnet built from home cameras and DVRs knocked a chunk of the internet offline. It didn't exploit anything clever. It logged in with the factory password.
In October 2021 Facebook didn't get hacked or DDoSed. It ran one maintenance command, and its own safety mechanisms erased it from the internet's map — then locked the engineers out of the room where the fix lived.