Hacker News Reader

Comment by nreece | Hacker News Reader

As as aside, I recently goofed up our company website DNS (updated a record on long TTL with an incorrect), but quickly fixed it and found a partial workaround to propagation: flush the DNS cache of Google[1] and Cloudflare[2]. It helped with DNS cache refresh within minutes from most global locations, if not all.

[1] https://dns.google/cache [2] https://1.1.1.1/purge-cache/

View on HN

OpenDNS was the first to expose cache clearing to end users: http://cachecheck.opendns.com/

I find it interesting that you can do this for any website at all…

It only costs them a single lookup

It's not an attack surface. You're posting relatively tons of data to ask them to do one small lookup.

It could be one aspect of a cache poisoning attack. One of the things DNSSEC was to protect against.

I was curious as to how a certificate could be issued to an IP address and not a domain (I didn't know that such a thing was possible), and learned this:

    X509v3 Subject Alternative Name: 
        DNS:cloudflare-dns.com, DNS:*.cloudflare-dns.com, DNS:one.one.one.one, IP Address:1.1.1.1, IP Address:1.0.0.1, IP Address:162.159.36.1, IP Address:162.159.46.1, IP Address:2606:4700:4700:0:0:0:0:1111, IP Address:2606:4700:4700:0:0:0:0:1001, IP Address:2606:4700:4700:0:0:0:0:64, IP Address:2606:4700:4700:0:0:0:0:6400

You can inspect the certificate yourself with:

    openssl s_client -showcerts -connect 1.1.1.1:443 < /dev/null | openssl x509 -text -noout

Too bad Let's Encrypt will not issue certificates for IP's at this time.

I just did it for fb.com. What impact does this have on such huge websites?

None. For the recursive resolver it is effectively the same as a TTL expiration. The next request initiates a recursion which adds a small number of milliseconds to the response time and is recached.

I would imagine it does some kind of atomic swap, where it's just force updating an existing cache and not actually flushing it.

The cache probably gets re-filled again pretty quickly, if you were to spam this endpoint it'd be more of a problem but I would assume/hope there's rate limiting on it.

Nice find! Filing that away for future reference.

Reply on news.ycombinator.com