The Domain Name System (DNS) aids internet communication by translating human-readable domain names into machine-friendly IP addresses. The DNS fundamentally relies on glue records to provide the IP addresses of authoritative nameservers, enabling subdomain delegation. While previous studies have identified potential security risks associated with glue records, the exploitation of these records, particularly in the context of out-domain delegation, remains unclear. These records are inherently less reliable, and resolvers handle them in various ways. The recursive traversal of the delegation chain between parent and child authoritative nameservers ensures domain name resolution. Parent domains contain delegation records that point to the designated nameservers of their subdomains. However, a paradoxical loop emerges when attempting to resolve a subdomain delegated by its parent domain (e.g., ns.foo.com, delegated by foo.com). This recursion is resolved using glue records, which contain nameserver IP addresses stored within the delegating parent's zone file and are only used in referral responses. Tasks: Evaluate the real-world impact of stale records by conducting measurements on open DNS resolvers. Gather empirical data showing that the vast majority of DNS resolvers in operation are vulnerable to exploitation due to stale glue records.

The Domain Name System (DNS) aids internet communication by translating human-readable domain names into machine-friendly IP addresses. The DNS fundamentally relies on glue records to provide the IP addresses of authoritative nameservers, enabling subdomain delegation. While previous studies have identified potential security risks associated with glue records, the exploitation of these records, particularly in the context of out-domain delegation, remains unclear. These records are inherently less reliable, and resolvers handle them in various ways. The recursive traversal of the delegation chain between parent and child authoritative nameservers ensures domain name resolution. Parent domains contain delegation records that point to the designated nameservers of their subdomains. However, a paradoxical loop emerges when attempting to resolve a subdomain delegated by its parent domain (e.g., ns.foo.com, delegated by foo.com). This recursion is resolved using glue records, which contain nameserver IP addresses stored within the delegating parent's zone file and are only used in referral responses. Tasks: Evaluate the real-world impact of stale records by conducting measurements on open DNS resolvers. Gather empirical data showing that the vast majority of DNS resolvers in operation are vulnerable to exploitation due to stale glue records.