Subject: [DNSOP] on zone enumeration and the futility of secrecy on authenticated denial

From: Paul Vixie <[email-masked]>
Date: Tue, 28 Mar 2017 10:41:39 -0700

at DNSOP yesterday i asked that anyone who thought zone enumeration was
a risk and that any crypto change (such as NSEC5) could manage that risk
should please accept a free demonstration of passive dns.

i realized that i could offer this more broadly. here is *.vix.su, one
of my vanity domains. passive dns works by storing cache miss traffic
(so there is no PII here). DNSDB, whose result is shown below, is one of
about a dozen security-community projects who aggregate these cache
misses into searchable databases.

summary: all dns content is running naked through the forest covered in
honey. if you put something into the dns, and it gets used, then it's
going to be known. no amount of crypto on dnssec authenticated denial is
going to change that. (nor will the DPRIVE effort, since passive dns
relies on inside-the-RDNS-servers cooperation, such as for example
'dnstap').

nsec5 is a work of beauty and wonder. but changing the DNSSEC protocol
every two years is why we're 19 years in and still lack ubiquitous
deployment. adding more complexity would have to pay back more cost than
any new form of authenticated denial could even theoretically do.

-- 
P Vixie

re:

;; record times: 2013-02-05T16:19:05Z .. 2017-03-28T10:38:22Z
;; count: 25052; bailiwick: vix.su
vix.su  A  24.104.150.231

;; record times: 2010-08-30T15:00:32Z .. 2010-11-01T06:13:16Z
;; count: 6; bailiwick: su
vix.su  NS  ns1.jino.ru.
        NS  ns2.jino.ru.

;; record times: 2016-03-27T05:57:22Z .. 2017-03-28T15:13:53Z
;; count: 141300; bailiwick: su
vix.su  NS  ns.lah1.vix.su.
        NS  ns3.isc-sns.info.

;; record times: 2012-03-22T04:57:11Z .. 2016-03-27T05:29:09Z
;; count: 36229; bailiwick: su
vix.su  NS  ns.sql1.vix.com.
        NS  ns2.isc-sns.com.
        NS  ns3.isc-sns.info.

;; record times: 2010-08-30T15:00:32Z .. 2010-11-01T06:13:17Z
;; count: 2; bailiwick: vix.su
vix.su  NS  ns1.jino.ru.
        NS  ns2.jino.ru.

;; record times: 2013-05-12T04:32:05Z .. 2016-03-24T16:50:13Z
;; count: 125604; bailiwick: vix.su
vix.su  NS  ns.lah1.vix.su.
        NS  ns1.isc-sns.net.
        NS  ns2.isc-sns.com.
        NS  ns3.isc-sns.info.

;; record times: 2016-03-24T16:57:48Z .. 2016-09-02T03:22:13Z
;; count: 40697; bailiwick: vix.su
vix.su  NS  ns.lah1.vix.su.
        NS  ns3.isc-sns.info.

;; record times: 2016-09-02T04:17:01Z .. 2017-03-28T10:38:22Z
;; count: 71414; bailiwick: vix.su
vix.su  NS  ns.lah1.vix.su.
        NS  ams.sns-pb.isc.org.
        NS  ord.sns-pb.isc.org.
        NS  sfba.sns-pb.isc.org.

;; record times: 2012-03-22T04:57:11Z .. 2013-05-12T00:52:54Z
;; count: 1488; bailiwick: vix.su
vix.su  NS  ns.sql1.vix.su.
        NS  ns1.isc-sns.net.
        NS  ns2.isc-sns.com.
        NS  ns3.isc-sns.info.

;; record times: 2014-10-09T22:10:41Z .. 2014-11-11T20:41:06Z
;; count: 457; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2014051900 3600
             1800604800 3600 )

;; record times: 2014-11-13T13:32:57Z .. 2014-11-16T02:33:27Z
;; count: 131; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2014111316 3600
             1800604800 3600 )

;; record times: 2014-11-16T09:27:08Z .. 2014-11-20T02:33:37Z
;; count: 158; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2014111623 3600
             1800604800 3600 )

;; record times: 2014-11-20T10:33:00Z .. 2014-11-26T22:46:02Z
;; count: 263; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2014112016 3600
             1800604800 3600 )

;; record times: 2014-11-27T05:09:01Z .. 2014-11-29T02:50:55Z
;; count: 81; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2014112716 3600
             1800604800 3600 )

;; record times: 2014-11-29T11:44:31Z .. 2014-12-03T22:44:54Z
;; count: 187; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2014112918 3600
             1800604800 3600 )

;; record times: 2014-12-04T08:10:58Z .. 2014-12-10T18:51:23Z
;; count: 245; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2014120416 3600
             1800604800 3600 )

;; record times: 2014-12-11T04:41:39Z .. 2014-12-17T22:53:24Z
;; count: 259; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2014121116 3600
             1800604800 3600 )

;; record times: 2014-12-18T10:49:06Z .. 2014-12-25T03:54:41Z
;; count: 545; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2014121816 3600
             1800604800 3600 )

;; record times: 2014-12-25T04:09:41Z .. 2015-01-01T03:54:41Z
;; count: 1009; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2014122516 3600
             1800604800 3600 )

;; record times: 2015-01-01T04:04:42Z .. 2015-01-02T14:04:41Z
;; count: 205; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015010116 3600
             1800604800 3600 )

;; record times: 2015-01-02T14:19:41Z .. 2015-01-07T16:09:41Z
;; count: 757; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015010259 3600
             1800604800 3600 )

;; record times: 2015-01-07T16:24:41Z .. 2015-01-08T03:49:41Z
;; count: 90; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015010767 3600
             1800604800 3600 )

;; record times: 2015-01-08T04:04:41Z .. 2015-01-10T15:34:41Z
;; count: 390; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015010816 3600
             1800604800 3600 )

;; record times: 2015-01-10T15:49:41Z .. 2015-01-14T05:44:41Z
;; count: 585; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015011065 3600
             1800604800 3600 )

;; record times: 2015-01-14T06:08:56Z .. 2015-01-15T03:54:41Z
;; count: 150; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015011424 3600
             1800604800 3600 )

;; record times: 2015-01-15T04:09:41Z .. 2015-01-22T04:00:54Z
;; count: 1127; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015011516 3600
             1800604800 3600 )

;; record times: 2015-01-22T04:15:53Z .. 2015-01-29T03:50:53Z
;; count: 1117; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015012216 3600
             1800604800 3600 )

;; record times: 2015-01-29T04:05:53Z .. 2015-02-05T04:02:57Z
;; count: 1131; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015012916 3600
             1800604800 3600 )

;; record times: 2015-02-05T04:17:57Z .. 2015-02-12T03:51:26Z
;; count: 1044; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015020516 3600
             1800604800 3600 )

;; record times: 2015-02-12T04:06:27Z .. 2015-02-19T03:55:40Z
;; count: 1063; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015021216 3600
             1800604800 3600 )

;; record times: 2015-02-19T04:10:40Z .. 2015-02-26T04:00:40Z
;; count: 1117; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015021916 3600
             1800604800 3600 )

;; record times: 2015-02-26T04:15:40Z .. 2015-03-05T03:51:53Z
;; count: 1035; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015022616 3600
             1800604800 3600 )

;; record times: 2015-03-05T04:06:52Z .. 2015-03-12T04:01:32Z
;; count: 1122; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015030516 3600
             1800604800 3600 )

;; record times: 2015-03-12T04:16:32Z .. 2015-03-19T03:50:04Z
;; count: 1119; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015031216 3600
             1800604800 3600 )

;; record times: 2015-03-19T04:05:03Z .. 2015-03-26T03:51:00Z
;; count: 1004; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015031916 3600
             1800604800 3600 )

;; record times: 2015-03-26T04:06:00Z .. 2015-04-02T03:50:14Z
;; count: 1111; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015032616 3600
             1800604800 3600 )

;; record times: 2015-04-02T04:05:14Z .. 2015-04-09T03:55:14Z
;; count: 1121; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015040216 3600
             1800604800 3600 )

;; record times: 2015-04-09T04:10:14Z .. 2015-04-16T03:54:12Z
;; count: 1132; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015040916 3600
             1800604800 3600 )

;; record times: 2015-04-16T04:09:12Z .. 2015-04-19T17:50:27Z
;; count: 559; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015041616 3600
             1800604800 3600 )

;; record times: 2015-04-19T18:05:27Z .. 2015-04-23T04:00:27Z
;; count: 497; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015041975 3600
             1800604800 3600 )

;; record times: 2015-04-23T04:15:27Z .. 2015-04-30T03:55:30Z
;; count: 1122; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015042316 3600
             1800604800 3600 )

;; record times: 2015-04-30T04:10:27Z .. 2015-05-07T04:01:53Z
;; count: 1119; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015043016 3600
             1800604800 3600 )

;; record times: 2015-05-07T04:16:53Z .. 2015-05-09T04:26:53Z
;; count: 319; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015050716 3600
             1800604800 3600 )

;; record times: 2015-05-09T04:41:53Z .. 2015-05-10T00:34:53Z
;; count: 125; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015050918 3600
             1800604800 3600 )

;; record times: 2015-05-10T00:49:53Z .. 2015-05-14T04:09:53Z
;; count: 631; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015051002 3600
             1800604800 3600 )

;; record times: 2015-05-14T04:24:53Z .. 2015-05-18T00:29:53Z
;; count: 605; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015051416 3600
             1800604800 3600 )

;; record times: 2015-05-18T00:44:53Z .. 2015-05-18T03:29:53Z
;; count: 13; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015051800 3600
             1800604800 3600 )

;; record times: 2015-05-18T03:44:53Z .. 2015-05-23T23:14:53Z
;; count: 945; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015051814 3600
             1800604800 3600 )

;; record times: 2015-05-23T23:29:53Z .. 2015-05-28T04:29:53Z
;; count: 672; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015052395 3600
             1800604800 3600 )

;; record times: 2015-05-28T04:44:53Z .. 2015-06-04T03:59:04Z
;; count: 1127; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015052816 3600
             1800604800 3600 )

;; record times: 2015-06-04T04:14:04Z .. 2015-06-11T03:59:26Z
;; count: 764; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015060416 3600
             1800604800 3600 )

;; record times: 2015-06-11T04:14:27Z .. 2015-06-18T04:05:54Z
;; count: 1052; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015061116 3600
             1800604800 3600 )

;; record times: 2015-06-18T04:20:55Z .. 2015-06-25T04:09:01Z
;; count: 1046; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015061816 3600
             1800604800 3600 )

;; record times: 2015-06-25T04:24:02Z .. 2015-06-30T23:04:01Z
;; count: 851; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015062516 3600
             1800604800 3600 )

;; record times: 2015-06-30T23:19:01Z .. 2015-06-30T23:19:01Z
;; count: 2; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015063095 3600
             1800604800 3600 )

;; record times: 2015-06-30T23:49:01Z .. 2015-07-02T04:29:01Z
;; count: 188; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015063098 3600
             1800604800 3600 )

;; record times: 2015-07-02T04:44:01Z .. 2015-07-09T04:04:03Z
;; count: 995; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015070216 3600
             1800604800 3600 )

;; record times: 2015-07-09T04:19:02Z .. 2015-07-16T04:11:21Z
;; count: 967; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015070916 3600
             1800604800 3600 )

;; record times: 2015-07-16T04:26:22Z .. 2015-07-23T04:12:37Z
;; count: 1045; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015071616 3600
             1800604800 3600 )

;; record times: 2015-07-23T04:27:38Z .. 2015-07-30T04:24:24Z
;; count: 1034; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015072316 3600
             1800604800 3600 )

;; record times: 2015-07-30T04:39:24Z .. 2015-08-06T03:55:43Z
;; count: 1048; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015073016 3600
             1800604800 3600 )

;; record times: 2015-08-06T04:10:44Z .. 2015-08-13T04:20:43Z
;; count: 1053; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015080616 3600
             1800604800 3600 )

;; record times: 2015-08-13T04:35:43Z .. 2015-08-20T04:36:37Z
;; count: 1059; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015081316 3600
             1800604800 3600 )

;; record times: 2015-08-20T04:51:36Z .. 2015-08-27T04:06:36Z
;; count: 1025; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015082016 3600
             1800604800 3600 )

;; record times: 2015-08-27T04:21:36Z .. 2015-09-03T04:14:51Z
;; count: 977; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015082716 3600
             1800604800 3600 )

;; record times: 2015-09-03T04:29:51Z .. 2015-09-10T03:59:51Z
;; count: 912; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015090316 3600
             1800604800 3600 )

;; record times: 2015-09-10T04:14:51Z .. 2015-09-17T03:59:51Z
;; count: 1017; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015091016 3600
             1800604800 3600 )

;; record times: 2015-09-17T04:14:51Z .. 2015-09-28T02:39:51Z
;; count: 1580; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015091716 3600
             1800604800 3600 )

;; record times: 2015-09-28T02:54:52Z .. 2015-10-22T04:24:20Z
;; count: 3075; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015092811 3600
             1800604800 3600 )

;; record times: 2015-10-22T05:24:20Z .. 2015-10-29T03:59:20Z
;; count: 776; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015102218 3600
             1800604800 3600 )

;; record times: 2015-10-29T04:14:20Z .. 2015-11-05T03:00:44Z
;; count: 905; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015102916 3600
             1800604800 3600 )

;; record times: 2015-11-05T04:45:44Z .. 2015-11-12T04:01:15Z
;; count: 658; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015110516 3600
             1800604800 3600 )

;; record times: 2015-11-12T04:16:15Z .. 2015-11-19T03:57:00Z
;; count: 882; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015111216 3600
             1800604800 3600 )

;; record times: 2015-11-19T04:12:01Z .. 2015-11-26T03:59:52Z
;; count: 873; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015111916 3600
             1800604800 3600 )

;; record times: 2015-11-26T04:14:51Z .. 2015-12-03T03:59:51Z
;; count: 915; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015112616 3600
             1800604800 3600 )

;; record times: 2015-12-03T04:14:51Z .. 2015-12-10T03:50:31Z
;; count: 865; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015120316 3600
             1800604800 3600 )

;; record times: 2015-12-10T04:05:31Z .. 2015-12-17T03:57:36Z
;; count: 889; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015121016 3600
             1800604800 3600 )

;; record times: 2015-12-17T04:12:36Z .. 2015-12-24T03:52:37Z
;; count: 927; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015121716 3600
             1800604800 3600 )

;; record times: 2015-12-24T04:22:37Z .. 2015-12-31T04:01:12Z
;; count: 909; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015122416 3600
             1800604800 3600 )

;; record times: 2015-12-31T04:16:12Z .. 2016-01-07T04:01:12Z
;; count: 825; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2015123116 3600
             1800604800 3600 )

;; record times: 2016-01-07T04:16:12Z .. 2016-01-14T04:01:12Z
;; count: 907; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016010716 3600
             1800604800 3600 )

;; record times: 2016-01-14T04:16:12Z .. 2016-01-21T04:03:42Z
;; count: 754; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016011416 3600
             1800604800 3600 )

;; record times: 2016-01-21T04:18:42Z .. 2016-01-28T04:03:42Z
;; count: 873; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016012116 3600
             1800604800 3600 )

;; record times: 2016-01-28T04:18:42Z .. 2016-02-04T03:43:22Z
;; count: 944; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016012816 3600
             1800604800 3600 )

;; record times: 2016-02-04T04:20:08Z .. 2016-02-11T03:53:14Z
;; count: 1020; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016020416 3600
             1800604800 3600 )

;; record times: 2016-02-11T04:08:14Z .. 2016-02-18T03:58:14Z
;; count: 1019; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016021116 3600
             1800604800 3600 )

;; record times: 2016-02-18T04:13:14Z .. 2016-02-25T03:53:14Z
;; count: 1019; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016021816 3600
             1800604800 3600 )

;; record times: 2016-02-25T04:08:14Z .. 2016-03-03T03:56:34Z
;; count: 1004; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016022516 3600
             1800604800 3600 )

;; record times: 2016-03-03T04:11:34Z .. 2016-03-10T03:38:23Z
;; count: 916; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016030316 3600
             1800604800 3600 )

;; record times: 2016-03-10T04:08:23Z .. 2016-03-14T00:08:23Z
;; count: 530; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016031016 3600
             1800604800 3600 )

;; record times: 2016-03-14T00:23:22Z .. 2016-03-17T04:03:22Z
;; count: 438; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016031400 3600
             1800604800 3600 )

;; record times: 2016-03-17T04:18:23Z .. 2016-03-21T04:18:23Z
;; count: 571; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016031716 3600
             1800604800 3600 )

;; record times: 2016-03-21T04:33:23Z .. 2016-03-24T04:03:23Z
;; count: 442; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016032118 3600
             1800604800 3600 )

;; record times: 2016-03-24T04:18:23Z .. 2016-03-24T16:48:23Z
;; count: 60; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016032416 3600
             1800604800 3600 )

;; record times: 2016-03-24T17:03:23Z .. 2016-03-31T03:56:11Z
;; count: 849; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016032470 3600
             1800604800 3600 )

;; record times: 2016-03-31T04:11:11Z .. 2016-04-07T04:01:11Z
;; count: 892; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016033116 3600
             1800604800 3600 )

;; record times: 2016-04-07T04:16:11Z .. 2016-04-14T04:02:15Z
;; count: 877; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016040716 3600
             1800604800 3600 )

;; record times: 2016-04-14T04:17:15Z .. 2016-04-21T03:57:07Z
;; count: 937; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016041416 3600
             1800604800 3600 )

;; record times: 2016-04-21T04:12:06Z .. 2016-04-28T03:57:07Z
;; count: 937; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016042116 3600
             1800604800 3600 )

;; record times: 2016-04-28T04:12:06Z .. 2016-05-05T03:57:07Z
;; count: 1052; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016042816 3600
             1800604800 3600 )

;; record times: 2016-05-05T04:12:07Z .. 2016-05-07T07:09:20Z
;; count: 326; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016050516 3600
             1800604800 3600 )

;; record times: 2016-05-07T07:24:20Z .. 2016-05-09T02:39:20Z
;; count: 270; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016050730 3600
             1800604800 3600 )

;; record times: 2016-05-09T02:54:19Z .. 2016-05-12T03:59:07Z
;; count: 506; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016050911 3600
             1800604800 3600 )

;; record times: 2016-05-12T04:09:07Z .. 2016-05-19T04:01:41Z
;; count: 1075; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016051216 3600
             1800604800 3600 )

;; record times: 2016-05-19T04:16:41Z .. 2016-05-26T03:56:41Z
;; count: 937; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016051916 3600
             1800604800 3600 )

;; record times: 2016-05-26T04:11:41Z .. 2016-06-02T03:51:41Z
;; count: 938; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016052616 3600
             1800604800 3600 )

;; record times: 2016-06-02T04:06:41Z .. 2016-06-09T04:02:53Z
;; count: 922; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016060216 3600
             1800604800 3600 )

;; record times: 2016-06-09T04:17:53Z .. 2016-06-16T04:02:53Z
;; count: 937; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016060916 3600
             1800604800 3600 )

;; record times: 2016-06-16T04:17:53Z .. 2016-06-23T04:00:26Z
;; count: 1081; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016061616 3600
             1800604800 3600 )

;; record times: 2016-06-23T04:10:26Z .. 2016-06-30T02:33:15Z
;; count: 650; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016062316 3600
             1800604800 3600 )

;; record times: 2016-06-30T10:33:02Z .. 2016-07-07T02:32:50Z
;; count: 253; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016063016 3600
             1800604800 3600 )

;; record times: 2016-07-07T10:33:24Z .. 2016-07-14T02:32:54Z
;; count: 262; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016070716 3600
             1800604800 3600 )

;; record times: 2016-07-14T10:33:37Z .. 2016-07-21T02:32:54Z
;; count: 265; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016071416 3600
             1800604800 3600 )

;; record times: 2016-07-21T10:32:50Z .. 2016-07-28T02:32:52Z
;; count: 256; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016072116 3600
             1800604800 3600 )

;; record times: 2016-07-28T10:33:06Z .. 2016-07-30T02:32:57Z
;; count: 74; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016072816 3600
             1800604800 3600 )

;; record times: 2016-07-30T10:32:47Z .. 2016-08-04T02:33:05Z
;; count: 135; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016073018 3600
             1800604800 3600 )

;; record times: 2016-08-04T10:32:58Z .. 2016-08-11T02:33:07Z
;; count: 259; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016080416 3600
             1800604800 3600 )

;; record times: 2016-08-11T10:32:57Z .. 2016-08-18T02:33:03Z
;; count: 259; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016081116 3600
             1800604800 3600 )

;; record times: 2016-08-18T10:32:54Z .. 2016-08-25T18:33:25Z
;; count: 268; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016081816 3600
             1800604800 3600 )

;; record times: 2016-08-26T02:33:04Z .. 2016-08-31T23:08:53Z
;; count: 226; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016082516 3600
             1800604800 3600 )

;; record times: 2016-09-02T18:32:43Z .. 2016-09-02T18:32:43Z
;; count: 13; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016090216 3600
             1800604800 3600 )

;; record times: 2016-09-03T02:32:48Z .. 2016-09-03T02:32:48Z
;; count: 13; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016090304 3600
             1800604800 3600 )

;; record times: 2016-09-03T10:33:00Z .. 2016-09-08T02:32:52Z
;; count: 342; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016090315 3600
             1800604800 3600 )

;; record times: 2016-09-08T10:33:20Z .. 2016-09-15T02:32:55Z
;; count: 511; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016090820 3600
             1800604800 3600 )

;; record times: 2016-09-15T10:32:59Z .. 2016-09-22T02:33:23Z
;; count: 518; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016091516 3600
             1800604800 3600 )

;; record times: 2016-09-22T10:32:59Z .. 2016-09-29T02:33:04Z
;; count: 515; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016092216 3600
             1800604800 3600 )

;; record times: 2016-09-29T10:32:56Z .. 2016-10-06T00:25:52Z
;; count: 394; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016092916 3600
             1800604800 3600 )

;; record times: 2016-10-07T02:32:52Z .. 2016-10-13T02:32:57Z
;; count: 463; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016100616 3600
             1800604800 3600 )

;; record times: 2016-10-13T10:32:45Z .. 2016-10-16T18:32:57Z
;; count: 268; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016101316 3600
             1800604800 3600 )

;; record times: 2016-10-17T00:40:37Z .. 2016-10-17T05:40:59Z
;; count: 29; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016101702 3600
             1800604800 3600 )

;; record times: 2016-10-17T10:32:54Z .. 2016-10-20T02:32:41Z
;; count: 236; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016101725 3600
             1800604800 3600 )

;; record times: 2016-10-20T10:33:15Z .. 2016-10-27T02:33:32Z
;; count: 552; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016102016 3600
             1800604800 3600 )

;; record times: 2016-10-27T10:33:25Z .. 2016-11-03T02:33:29Z
;; count: 532; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016102716 3600
             1800604800 3600 )

;; record times: 2016-11-03T10:33:13Z .. 2016-11-10T02:33:33Z
;; count: 522; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016110316 3600
             1800604800 3600 )

;; record times: 2016-11-10T10:33:09Z .. 2016-11-17T02:33:15Z
;; count: 522; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016111016 3600
             1800604800 3600 )

;; record times: 2016-11-17T10:32:41Z .. 2016-11-24T02:33:00Z
;; count: 534; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016111716 3600
             1800604800 3600 )

;; record times: 2016-11-24T10:32:38Z .. 2016-12-01T02:33:19Z
;; count: 522; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016112416 3600
             1800604800 3600 )

;; record times: 2016-12-01T10:32:58Z .. 2016-12-08T02:33:20Z
;; count: 435; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016120116 3600
             1800604800 3600 )

;; record times: 2016-12-08T10:33:08Z .. 2016-12-15T02:33:01Z
;; count: 530; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016120816 3600
             1800604800 3600 )

;; record times: 2016-12-15T06:23:33Z .. 2016-12-22T02:32:48Z
;; count: 543; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016121516 3600
             1800604800 3600 )

;; record times: 2016-12-22T10:32:43Z .. 2016-12-23T18:33:25Z
;; count: 114; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016122216 3600
             1800604800 3600 )

;; record times: 2016-12-24T02:33:10Z .. 2016-12-29T02:33:33Z
;; count: 407; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016122406 3600
             1800604800 3600 )

;; record times: 2016-12-29T10:33:16Z .. 2017-01-05T02:33:02Z
;; count: 563; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2016122916 3600
             1800604800 3600 )

;; record times: 2017-01-05T10:32:50Z .. 2017-01-12T03:58:26Z
;; count: 568; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2017010516 3600
             1800604800 3600 )

;; record times: 2017-01-12T05:00:33Z .. 2017-01-19T02:32:58Z
;; count: 581; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2017011216 3600
             1800604800 3600 )

;; record times: 2017-01-19T10:32:51Z .. 2017-01-26T02:32:55Z
;; count: 509; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2017011916 3600
             1800604800 3600 )

;; record times: 2017-01-26T06:37:49Z .. 2017-02-02T02:33:08Z
;; count: 374; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2017012616 3600
             1800604800 3600 )

;; record times: 2017-02-02T06:16:13Z .. 2017-02-09T02:33:33Z
;; count: 470; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2017020216 3600
             1800604800 3600 )

;; record times: 2017-02-09T10:33:17Z .. 2017-02-16T03:28:59Z
;; count: 224; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2017020916 3600
             1800604800 3600 )

;; record times: 2017-02-17T17:12:09Z .. 2017-02-19T10:33:44Z
;; count: 68; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2017021616 3600
             1800604800 3600 )

;; record times: 2017-02-21T10:33:07Z .. 2017-02-22T18:33:14Z
;; count: 50; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2017022097 3600
             1800604800 3600 )

;; record times: 2017-02-23T18:33:28Z .. 2017-03-02T02:33:30Z
;; count: 312; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2017022316 3600
             1800604800 3600 )

;; record times: 2017-03-02T18:33:45Z .. 2017-03-09T03:17:29Z
;; count: 260; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2017030216 3600
             1800604800 3600 )

;; record times: 2017-03-09T10:50:00Z .. 2017-03-15T15:20:59Z
;; count: 208; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2017030916 3600
             1800604800 3600 )

;; record times: 2017-03-16T22:58:00Z .. 2017-03-22T22:32:55Z
;; count: 325; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2017031616 3600
             1800604800 3600 )

;; record times: 2017-03-23T06:58:50Z .. 2017-03-28T10:38:22Z
;; count: 274; bailiwick: vix.su
vix.su  SOA  ( ns.lah1.vix.su. hostmaster.vix.su. 2017032316 3600
             1800604800 3600 )

;; record times: 2013-05-13T22:40:37Z .. 2015-01-02T12:01:08Z
;; count: 5519; bailiwick: vix.su
vix.su  MX  10 ss.vix.su.

;; record times: 2012-03-30T15:32:50Z .. 2013-05-13T20:03:22Z
;; count: 288; bailiwick: vix.su
vix.su  MX  5 nsa.vix.su.

;; record times: 2010-08-30T15:00:32Z .. 2010-08-30T15:00:32Z
;; count: 1; bailiwick: vix.su
vix.su  MX  5 mail.vix.su.

;; record times: 2015-01-02T19:04:32Z .. 2016-12-23T19:14:03Z
;; count: 25027; bailiwick: vix.su
vix.su  MX  10 util.redbarn.org.

;; record times: 2016-12-24T02:33:10Z .. 2017-03-28T10:38:22Z
;; count: 3311; bailiwick: vix.su
vix.su  MX  10 util.redbarn.org.
        MX  65535 tarbaby.junkemailfilter.com.

;; record times: 2013-05-13T20:03:37Z .. 2017-03-28T10:38:22Z
;; count: 18508; bailiwick: vix.su
vix.su  TXT  "$Id: vix.su,v 1.210 2011/05/03 18:35:23 vixie Exp $"

;; record times: 2013-03-28T20:10:12Z .. 2017-03-28T10:38:22Z
;; count: 18698; bailiwick: vix.su
vix.su  AAAA  2001:559:8000::4

;; record times: 2013-11-30T02:49:42Z .. 2014-03-12T04:10:53Z
;; count: 15; bailiwick: vix.su
fm.vix.su  CNAME  vix.su.

;; record times: 2013-05-19T03:53:42Z .. 2013-05-19T03:53:42Z
;; count: 3; bailiwick: vix.su
mm.vix.su  A  24.104.150.11

;; record times: 2012-05-01T17:20:33Z .. 2015-01-07T15:49:41Z
;; count: 48053; bailiwick: vix.su
ss.vix.su  A  24.104.150.2

;; record times: 2015-01-07T16:54:43Z .. 2017-03-16T23:26:24Z
;; count: 20886; bailiwick: vix.su
ss.vix.su  CNAME  family.redbarn.org.

;; record times: 2013-01-03T05:32:15Z .. 2015-01-07T15:49:41Z
;; count: 28485; bailiwick: vix.su
ss.vix.su  AAAA  2001:559:8000:cb::2

;; record times: 2014-01-25T04:27:12Z .. 2014-02-18T19:45:50Z
;; count: 6; bailiwick: vix.su
ss.vix.su  SSHFP  \# 22 01 01 05 24 eb 7f 41 30 af 1e 53 78 43 02 6a e2
37 b9 62 50 47 1e
           SSHFP  \# 22 02 01 71 6b 19 f3 fe 3e 18 8f 12 72 70 3d 31 8c
d3 e6 fe 67 3b 1d
           SSHFP  \# 22 03 01 33 63 05 0b 00 f4 95 2a 63 d7 a0 40 d6 d0
22 60 17 53 68 2d
           SSHFP  ( \# 34 01 02 db 79 da 4f 92 05 31 fa 59 9e 6b ba 2a
48 19 3d de 92 cf b0 a0
                  30d0 f1 99 19 f0 a1 9f e0 c5 b9  )
           SSHFP  ( \# 34 02 02 a2 a4 ef 35 e6 02 3f 62 af 09 05 a7 23
78 e8 46 13 e6 73 4e 2d
                  ffe1 a3 b3 db dc 6a f4 7e 81 13  )
           SSHFP  ( \# 34 03 02 69 94 7e 2b 0e f5 d0 1b 70 c7 92 a3 73
80 0a 7d 9d 80 a8 68 be
                  f389 68 f3 ce d9 4c 39 01 67 b4  )

;; record times: 2014-09-05T07:20:48Z .. 2015-08-06T05:33:02Z
;; count: 4; bailiwick: vix.su
wireless.ss.vix.su  A  24.104.150.66

;; record times: 2014-09-05T04:53:06Z .. 2016-04-03T02:20:11Z
;; count: 4; bailiwick: vix.su
wireless.ss.vix.su  AAAA  2001:559:8000:c9::2

;; record times: 2013-11-25T04:59:20Z .. 2014-08-04T19:00:27Z
;; count: 3576; bailiwick: vix.su
telephony.ss.vix.su  A  24.104.150.98

;; record times: 2013-12-06T03:52:41Z .. 2014-03-11T17:39:07Z
;; count: 25; bailiwick: vix.su
ww.vix.su  A  24.104.150.12

;; record times: 2013-10-26T09:23:38Z .. 2014-02-16T19:27:31Z
;; count: 23; bailiwick: vix.su
ww.vix.su  AAAA  2001:559:8000:cb:ad08:e2c8:841b:7477

;; record times: 2012-03-22T04:57:21Z .. 2013-07-24T19:23:25Z
;; count: 605; bailiwick: vix.su
nsa.vix.su  A  149.20.48.227

;; record times: 2012-03-22T04:57:11Z .. 2013-07-24T19:23:25Z
;; count: 595; bailiwick: vix.su
nsa.vix.su  AAAA  2001:4f8:3:30::3

;; record times: 2016-07-30T05:21:55Z .. 2016-12-19T13:23:43Z
;; count: 5; bailiwick: vix.su
st1.vix.su  A  24.104.150.195

;; record times: 2016-10-26T08:24:57Z .. 2016-10-26T08:24:57Z
;; count: 2; bailiwick: vix.su
st1.vix.su  AAAA  2001:559:8000:cd::195

;; record times: 2013-03-28T15:18:06Z .. 2016-12-23T20:14:36Z
;; count: 205; bailiwick: vix.su
www.vix.su  CNAME  vix.su.

;; record times: 2016-03-27T05:57:22Z .. 2017-03-28T15:13:53Z
;; count: 141300; bailiwick: su
ns.lah1.vix.su  A  24.104.150.234

;; record times: 2013-05-12T04:32:05Z .. 2017-03-28T10:45:17Z
;; count: 567963; bailiwick: vix.su
ns.lah1.vix.su  A  24.104.150.234

;; record times: 2013-05-12T04:32:05Z .. 2017-03-28T10:45:17Z
;; count: 568094; bailiwick: vix.su
ns.lah1.vix.su  AAAA  2001:559:8000::2

;; record times: 2013-11-25T04:25:12Z .. 2014-08-05T21:56:58Z
;; count: 3532; bailiwick: vix.su
cat.lah1.vix.su  A  24.104.150.225

;; record times: 2013-12-04T02:13:14Z .. 2014-08-05T21:56:58Z
;; count: 30; bailiwick: vix.su
cat.lah1.vix.su  AAAA  2001:559:8000::1

;; record times: 2015-04-06T20:26:14Z .. 2015-04-06T20:26:14Z
;; count: 2; bailiwick: vix.su
internal.cat.lah1.vix.su  A  24.104.150.1

;; record times: 2015-08-17T02:52:42Z .. 2015-08-17T02:52:42Z
;; count: 2; bailiwick: vix.su
wireless.cat.lah1.vix.su  A  24.104.150.65

;; record times: 2017-01-03T00:17:56Z .. 2017-01-03T00:17:56Z
;; count: 2; bailiwick: vix.su
gw1.lah1.vix.su  A  24.104.150.225

;; record times: 2016-12-13T04:35:39Z .. 2016-12-13T04:35:39Z
;; count: 2; bailiwick: vix.su
access.gw1.lah1.vix.su  A  24.104.150.129

;; record times: 2016-08-08T06:59:43Z .. 2016-12-31T10:29:24Z
;; count: 6; bailiwick: vix.su
service.gw1.lah1.vix.su  A  24.104.150.209

;; record times: 2017-01-22T15:11:47Z .. 2017-01-22T15:11:47Z
;; count: 2; bailiwick: vix.su
external.gw1.lah1.vix.su  A  24.104.150.33

;; record times: 2016-12-19T22:48:20Z .. 2017-02-13T03:07:58Z
;; count: 7; bailiwick: vix.su
internal.gw1.lah1.vix.su  A  24.104.150.1

;; record times: 2016-12-03T08:39:42Z .. 2016-12-03T08:39:42Z
;; count: 2; bailiwick: vix.su
telephony.gw1.lah1.vix.su  A  24.104.150.97

;; record times: 2017-02-24T17:08:49Z .. 2017-03-21T15:57:51Z
;; count: 14; bailiwick: vix.su
dhcp-148.access.lah1.vix.su  A  24.104.150.148

;; record times: 2017-02-23T14:47:55Z .. 2017-03-27T05:49:31Z
;; count: 40; bailiwick: vix.su
dhcp-154.access.lah1.vix.su  A  24.104.150.154

;; record times: 2017-02-28T23:01:17Z .. 2017-03-02T18:45:53Z
;; count: 6; bailiwick: vix.su
dhcp-177.access.lah1.vix.su  A  24.104.150.177

;; record times: 2013-08-02T12:24:10Z .. 2013-08-02T12:24:10Z
;; count: 2; bailiwick: vix.su
ap-kit.lah1.vix.su  A  24.104.150.67

;; record times: 2016-12-18T20:19:58Z .. 2016-12-18T20:19:58Z
;; count: 2; bailiwick: vix.su
ap-olr.lah1.vix.su  A  24.104.150.132

;; record times: 2016-11-29T15:13:04Z .. 2016-11-29T15:13:04Z
;; count: 2; bailiwick: vix.su
ap-nmbr.lah1.vix.su  A  24.104.150.133

;; record times: 2016-12-13T07:33:11Z .. 2016-12-13T07:33:11Z
;; count: 2; bailiwick: vix.su
ap-ombr.lah1.vix.su  A  24.104.150.131

;; record times: 2016-12-26T16:39:01Z .. 2016-12-26T16:39:01Z
;; count: 2; bailiwick: vix.su
bcast.service.lah1.vix.su  A  24.104.150.223

;; record times: 2014-07-08T20:22:55Z .. 2015-01-27T01:13:20Z
;; count: 3; bailiwick: vix.su
net.external.lah1.vix.su  A  255.255.255.224

;; record times: 2014-08-04T22:17:34Z .. 2016-12-04T06:16:22Z
;; count: 23; bailiwick: vix.su
bcast.external.lah1.vix.su  A  24.104.150.63

;; record times: 2016-12-26T03:20:35Z .. 2016-12-26T03:20:35Z
;; count: 2; bailiwick: vix.su
bcast.internal.lah1.vix.su  A  24.104.150.31

;; record times: 2014-10-16T23:22:20Z .. 2014-10-16T23:22:20Z
;; count: 2; bailiwick: vix.su
bcast.wireless.lah1.vix.su  A  24.104.150.95

;; record times: 2016-12-26T18:13:27Z .. 2016-12-26T18:13:27Z
;; count: 2; bailiwick: vix.su
bcast.wireless.lah1.vix.su  A  24.104.150.191

;; record times: 2013-11-25T15:08:01Z .. 2015-11-09T06:25:30Z
;; count: 17; bailiwick: vix.su
dhcp-71.wireless.lah1.vix.su  A  24.104.150.71

;; record times: 2013-05-28T03:24:48Z .. 2016-05-01T02:29:31Z
;; count: 6; bailiwick: vix.su
dhcp-72.wireless.lah1.vix.su  A  24.104.150.72

;; record times: 2015-11-24T17:03:41Z .. 2015-11-25T15:48:12Z
;; count: 13; bailiwick: vix.su
dhcp-73.wireless.lah1.vix.su  A  24.104.150.73

;; record times: 2015-03-15T20:55:49Z .. 2016-01-08T18:02:33Z
;; count: 4; bailiwick: vix.su
dhcp-74.wireless.lah1.vix.su  A  24.104.150.74

;; record times: 2015-11-08T04:15:40Z .. 2016-04-22T17:54:13Z
;; count: 7; bailiwick: vix.su
dhcp-75.wireless.lah1.vix.su  A  24.104.150.75

;; record times: 2013-05-25T04:37:01Z .. 2013-06-10T02:34:01Z
;; count: 8; bailiwick: vix.su
dhcp-77.wireless.lah1.vix.su  A  24.104.150.77

;; record times: 2013-05-21T04:31:24Z .. 2015-11-10T18:08:53Z
;; count: 11; bailiwick: vix.su
dhcp-78.wireless.lah1.vix.su  A  24.104.150.78

;; record times: 2013-07-26T20:06:51Z .. 2016-03-19T06:53:52Z
;; count: 63; bailiwick: vix.su
dhcp-79.wireless.lah1.vix.su  A  24.104.150.79

;; record times: 2016-04-26T15:47:19Z .. 2016-05-06T16:33:07Z
;; count: 33; bailiwick: vix.su
dhcp-80.wireless.lah1.vix.su  A  24.104.150.80

;; record times: 2013-11-27T06:07:23Z .. 2015-11-30T03:18:24Z
;; count: 75; bailiwick: vix.su
dhcp-81.wireless.lah1.vix.su  A  24.104.150.81

;; record times: 2013-11-25T07:35:19Z .. 2016-04-25T17:26:29Z
;; count: 391; bailiwick: vix.su
dhcp-82.wireless.lah1.vix.su  A  24.104.150.82

;; record times: 2014-03-08T18:49:40Z .. 2014-03-08T18:49:40Z
;; count: 1; bailiwick: vix.su
dhcp-83.wireless.lah1.vix.su  A  24.104.150.83

;; record times: 2013-05-31T22:43:39Z .. 2013-06-07T21:58:34Z
;; count: 9; bailiwick: vix.su
dhcp-84.wireless.lah1.vix.su  A  24.104.150.84

;; record times: 2013-12-31T20:16:19Z .. 2015-10-15T08:20:02Z
;; count: 71; bailiwick: vix.su
dhcp-85.wireless.lah1.vix.su  A  24.104.150.85

;; record times: 2013-12-31T06:02:50Z .. 2015-11-26T02:20:42Z
;; count: 15; bailiwick: vix.su
dhcp-86.wireless.lah1.vix.su  A  24.104.150.86

;; record times: 2014-03-14T14:11:23Z .. 2015-12-29T17:18:09Z
;; count: 43; bailiwick: vix.su
dhcp-87.wireless.lah1.vix.su  A  24.104.150.87

;; record times: 2014-02-08T03:18:46Z .. 2016-03-18T21:24:48Z
;; count: 38; bailiwick: vix.su
dhcp-88.wireless.lah1.vix.su  A  24.104.150.88

;; record times: 2013-12-01T21:20:31Z .. 2015-11-21T07:40:10Z
;; count: 237; bailiwick: vix.su
dhcp-89.wireless.lah1.vix.su  A  24.104.150.89

;; record times: 2015-05-19T18:40:57Z .. 2015-12-12T06:34:27Z
;; count: 26; bailiwick: vix.su
dhcp-90.wireless.lah1.vix.su  A  24.104.150.90

;; record times: 2014-12-01T07:15:25Z .. 2014-12-05T07:40:54Z
;; count: 4; bailiwick: vix.su
dhcp-91.wireless.lah1.vix.su  A  24.104.150.91

;; record times: 2014-03-21T00:08:27Z .. 2015-12-11T18:31:46Z
;; count: 89; bailiwick: vix.su
dhcp-92.wireless.lah1.vix.su  A  24.104.150.92

;; record times: 2016-03-31T00:10:33Z .. 2016-04-22T16:13:00Z
;; count: 37; bailiwick: vix.su
dhcp-94.wireless.lah1.vix.su  A  24.104.150.94

;; record times: 2016-12-19T22:05:08Z .. 2016-12-19T22:05:08Z
;; count: 2; bailiwick: vix.su
bcast.telephony.lah1.vix.su  A  24.104.150.127

;; record times: 2010-08-30T15:00:32Z .. 2010-08-30T15:00:32Z
;; count: 1; bailiwick: vix.su
mail.vix.su  A  81.177.6.213

;; record times: 2012-03-22T04:57:11Z .. 2013-05-12T00:52:54Z
;; count: 1488; bailiwick: vix.su
ns.sql1.vix.su  A  204.152.184.135

;; record times: 2012-03-22T04:57:11Z .. 2013-05-12T00:52:54Z
;; count: 1488; bailiwick: vix.su
ns.sql1.vix.su  AAAA  2001:4f8:3::9

;; record times: 2014-01-04T06:06:30Z .. 2014-01-20T07:50:32Z
;; count: 7; bailiwick: vix.su
timg.vix.su  A  24.104.150.39

;; record times: 2014-01-04T07:14:23Z .. 2014-01-20T07:50:32Z
;; count: 5; bailiwick: vix.su
timg.vix.su  AAAA  2001:559:8000:ca::39

;; record times: 2014-01-04T06:06:30Z .. 2014-01-04T06:06:30Z
;; count: 1; bailiwick: vix.su
timg.vix.su  AAAA  2001:559:8000:cb::39

;; record times: 2014-01-20T08:49:52Z .. 2014-01-21T01:41:26Z
;; count: 4; bailiwick: vix.su
anejo.vix.su  A  24.104.150.40

;; record times: 2014-01-20T08:49:52Z .. 2014-01-21T01:41:26Z
;; count: 3; bailiwick: vix.su
anejo.vix.su  AAAA  2001:559:8000:ca::40

;; record times: 2010-11-01T06:13:17Z .. 2010-11-01T06:13:17Z
;; count: 1; bailiwick: vix.su
x-sto.vix.su  A  81.177.6.212

;; record times: 2013-11-25T21:04:59Z .. 2014-04-25T20:54:38Z
;; count: 643; bailiwick: vix.su
cyrene.vix.su  A  24.104.150.13

;; record times: 2014-01-20T08:50:09Z .. 2014-01-20T19:29:35Z
;; count: 3; bailiwick: vix.su
asbyrgi.vix.su  A  24.104.150.39

;; record times: 2014-01-20T08:50:09Z .. 2014-01-20T19:29:36Z
;; count: 3; bailiwick: vix.su
asbyrgi.vix.su  AAAA  2001:559:8000:ca::39

;; record times: 2015-04-14T19:52:45Z .. 2015-04-14T20:06:58Z
;; count: 4; bailiwick: vix.su
dhcp-100.vix.su  A  24.104.150.100

;; record times: 2013-01-03T18:00:50Z .. 2014-03-01T05:27:00Z
;; count: 19; bailiwick: vix.su
gutentag.vix.su  A  24.104.150.18

;; record times: 2014-03-21T15:42:15Z .. 2014-03-21T15:42:15Z
;; count: 1; bailiwick: vix.su
localhost.vix.su  A  127.0.0.1

;; record times: 2015-01-14T06:08:56Z .. 2015-01-14T06:08:56Z
;; count: 2; bailiwick: vix.su
somewhere.vix.su  CNAME  nowhere.vix.su.

;; record times: 2013-11-25T04:20:22Z .. 2014-04-26T02:40:39Z
;; count: 3325; bailiwick: vix.su
reject-all.vix.su  NS  ns.lah1.vix.su.

---

From: Shumon Huque <[email-masked]>
Date: Wed, 29 Mar 2017 12:32:05 -0500

> relies on inside-the-RDNS-servers cooperation, such as for example

Hi Paul,

I'm quite familiar with DNSDB and similar passive DNS systems and would
guess that many in the DNSOP crowd are also. Some years ago, when I
worked in the US R&E  community, I used DNSDB to enumerate most of the
.edu TLD to do DNSSEC deployment statistics and analyses.

These systems see a lot, no doubt, but they are still limited to data
contributed by the set of participating resolvers. And as far as I know,
they aren't open to inspection by the world (usually only participating
resolvers, researchers, and customers of the passive DNS service).

The fact that systems like this exist, does not invalidate the desire
for the DNS protocol to prevent easy "bulk disclosure" of zone content.
The DNS privacy considerations RFC for example has a section that
provides such arguments - the protocol queries public data, but you have
to know what to query for, and mechanisms that permit mass leakage of
such data are undesirable. Similarly, the fact that website observatories
exist doesn't mean that the web protocol should provide a mechanism to
enumerate all website names hosted at a CDN for example.

Before DNSSEC, enumerating zone content was only possible by means
of online queries of candidate names. NSEC and NSEC3 made that problem
strictly worse (walking the NSEC chain, and offline dictionary attack
of the NSEC3 chain). NSEC5 restores the pre-DNSSEC property that only
online guessing works.

Perhaps passive dns will become so prevalent, all-encompassing, and
accessible that it isn't worth investing time in doing better than NSEC3,
but let's have that discussion as a community.

> any new form of authenticated denial could even theoretically do.

I don't think protocol evolution can be blamed for lack of ubiquitous
DNSSEC deployment. In my experience, most people who haven't
deployed it, don't see any immediate compelling need for it. If cache
poisoning and DNS MITM attacks were happening on a large scale
(they aren't), that would act as a deployment incentive. If there were
a killer app that depended on DNSSEC (perhaps DANE will be that
some day down the road), that would also be an incentive.

Another deployment disincentive is that DNSSEC has a generally
bad rap in the larger technical community. Much of it is based on
FUD and misunderstanding. But there are legitimate criticisms that we
ought to be paying more attention to - DNSSEC deployment is littered
with 1024-bit RSA is one. Zone enumeration obviously is another.

Shumon.

---

From: Paul Vixie <[email-masked]>
Date: Wed, 29 Mar 2017 11:32:51 -0700

Shumon Huque wrote:
> 2017-03-28 12:41 GMT-05:00 Paul Vixie <[email-masked]:
> 
>     ...
> 
> ...
> contributed by the set of participating resolvers. ...

DNSDB coverage gets better every year. other passive systems report the
same. systems of this kind are vital for both operational security and
security research, and are part of a very strong and virtuous cycle.

> And as far as I know, they aren't open to inspection by the world
> (usually only participating resolvers, researchers, and customers of
> the passive DNS service).

for the purpose of this thread, that doesn't matter. anyone who wants to
enumerate dns content can do so, well enough, given access to one or
more passive dns systems, which is more available and also easier than
enumeration, especially because it does not rely on active queries, so
the zone administrator can't detect it.

under nsec5, something that's already harder to do than passive dns,
will get harder. this is an irrelevant benefit, with a very relevant cost.

the only practical benefit of nsec3 is opt-out, and this was true even
before the pre-image enumeration vulnerability was "discovered". nsec3's
anti-enumeration capability was merely a necessary "fig leaf" for some
cctld operators whose national privacy laws prohibited NSEC-walking.

> for the DNS protocol to prevent easy "bulk disclosure" of zone content.

yes, it does.

> deployed it, don't see any immediate compelling need for it.

had we completed the work after nine years, so, ten years ago, and had
there been no new flag days since then, i think it would be generally
implemented by recursives (validation), authorities (signatures),
registries and registrars. and there might be an app or two, such as
DANE, in general use.

> with 1024-bit RSA is one. Zone enumeration obviously is another. 

i can post more exerpts from the dns-security mailing list from 1996, or
from dnsind in 2005, if i've failed to convince you. there is no
generally perceived benefit from dnssec deployment today, but that is an
effect of the nineteen (19) years we have now been "working on it".

if there's no market for dnssec itself, then for that reason and to
exactly the same extent, there is no market for nsec5. if anyone would
like a demo of passive dns, please send me some nameservers, or ip
address blocks, or domain names. because, if you put something in the
dns, and somebody looks it up (ever), then it is public information. we
have got to stop arguing that it can be simultaneously kept secret.

-- 
P Vixie