Hacker News Reader

Hi paraschopra. What does it do when the request using the cached DNS fails? In conversations with security experts researching DNS re-binding attacks, I've heard that pinning is dropped after one failed request, as techniques like sending multiple A records for a domain depend on this. Also see my comments to forkqueue.

View on HN

In my experience it doesn't request DNS again if request fails. Waits till TTL expires. Multiple A records are useful if you have all servers exactly synchronized (as request can go to any server) plus on the moment of server failing it will still doesn't help as IE will keep reconnecting to same IP.

Though I haven't tested multiple A records.

Thanks, I'll look into this more. In the case of Mammatus response, the TTL would already be expired, so the only problem would be if it pinned for longer and didn't request again on failure.

Reply on news.ycombinator.com