Subject: Another Bogus DNS wildcard ??

From: Doug Royer <[email-masked]>
Date: Tue, 19 Apr 2005 00:11:38 -0600

If I ping an invalid host name everything points to:

	host152.theplanet.com (216.234.246.152)

However only from some subnets on the internet
and only some of the time.

Is this on purpose ?? Is someone getting ready to do a
DNS catch all again like (whoever it was) a few months ago ?

Its really odd:  foo.dom.com exists and dom.com does not
exist as a host name. Yet when I ping dom.com it points to
and pings the above IP.

-- 

Doug Royer                     | http://INET-Consulting.com
-------------------------------|-----------------------------

               We Do Standards - You Need Standards

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Bruce Lilly <[email-masked]>
Date: Tue, 19 Apr 2005 12:50:15 -0400

>  Date: 2005-04-19 02:11
>  From: Doug Royer <[email-masked]>

> Message was signed with key 0x72007B99C34AA62D.
>  
> Status: Bad signature.

> DNS catch all again like (whoever it was) a few months ago ?

Unless there was a recent incident, I think you mean a year and a
half ago.  See
                   SSAC Report: Redirection in the Com and Net Domains,
                   A Report From the ICANN Security and Stability
                   Advisory Committee (SSAC), 9 July 2004
http://secsac.icann.org/ 

> exist as a host name. Yet when I ping dom.com it points to

I'm not seeing that here:
# nslookup -type=any dom.com
Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
dom.com nameserver = ns2.dom.com.
dom.com nameserver = ns1.dom.com.

Authoritative answers can be found from:
dom.com nameserver = ns1.dom.com.
dom.com nameserver = ns2.dom.com.

# nslookup -type=any dom.com ns1.dom.com
Server:         ns1.dom.com
Address:        158.106.50.124#53

dom.com mail exchanger = 10 innm02.dom.com.
dom.com mail exchanger = 10 pghm02.dom.com.
dom.com mail exchanger = 10 innm01.dom.com.
dom.com mail exchanger = 10 pghm01.dom.com.
Name:   dom.com
Address: 158.106.49.17
dom.com nameserver = ns1.dom.com.
dom.com nameserver = ns2.dom.com.
dom.com
        origin = ns1.dom.com
        mail addr = Postmaster.eaoweb.dom.com
        serial = 2005041305
        refresh = 10800
        retry = 3600
        expire = 604800
        minimum = 86400

# whois dom.com

Whois Server Version 1.3

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

   Domain Name: DOM.COM
   Registrar: NETWORK SOLUTIONS, LLC.
   Whois Server: whois.networksolutions.com
   Referral URL: http://www.networksolutions.com
   Name Server: NS1.DOM.COM
   Name Server: NS2.DOM.COM
   Status: REGISTRAR-LOCK
   Updated Date: 20-oct-2004
   Creation Date: 22-jul-1998
   Expiration Date: 21-jul-2007

>>> Last update of whois database: Tue, 19 Apr 2005 08:35:25 EDT <<<

[...]

Registrant:
Dominion Resources Services Inc. (DOM34-DOM)
   P.O. Box 26532
   Richmond, VA 23261
   US

   Domain Name: DOM.COM

   Administrative Contact, Technical Contact:
      Leigh, James  (28863335I)         [email-masked]
      Dominion Resources Services Inc.
      P. O. Box 26666
      Richmond, VA 23261
      US
      (804) 771-4636 fax: (804) 273-2181

   Record expires on 21-Jul-2007.
   Record created on 22-Jul-1998.
   Database last updated on 19-Apr-2005 12:46:32 EDT.

   Domain servers in listed order:

   NS1.DOM.COM                  158.106.50.124
   NS2.DOM.COM                  158.106.45.7

Perhaps there are some bogus and/or stale DNS cache entries (positive
and negative).