JH Software News

Atom Publishing Protocol (AtomPub) server library for ASP.NET

Tue, 31 Aug 2010 21:50:21 GMT

Just released - for details click here

New reports of DNS amplification / DDoS attacks

Tue, 10 Aug 2010 16:56:00 GMT

Over the past few days, a number of Simple DNS Plus users have reported that they are receiving a lot of incoming DNS requests for <root> and/or various unknown domain names - typically originating from a limited number of IP addresses. We have also noticed reports of this with other DNS servers on various forums etc.

If you see something similar, this may be an indication that someone is abusing your DNS server as part of a so-called DNS amplification attack against a third party - the owner of the IP address that the DNS requests appear to originate from.
By sending a DNS request from a spoofed IP address, the attacker attempts to trick your DNS server into sending a DNS response packet to the victim and thereby become part of a DDoS attack. Typically the request is designed to trigger a response packet which is larger than the original request packet - thus the amplification.

We do NOT recommend blocking the sender's IP address on your firewall, with IPSec, or anything else at the IP address level - that is exactly what the attacker wants you to do! By blocking the apparent sender IP addresses, you are really blocking the victim rather than the attacker - because the sender IP address is spoofed as the victim's.
The aim of the attack is twofold: (1) overload the victim's Internet connection with large DNS responses, and (2) make everybody firewall the victim, so he can't use his connection even after the attack.

The best way to counter this type of attack is to make your DNS server unattractive as a "way-point". You do this by configuring Simple DNS Plus to either ignore or refuse lame requests.

First, in the Options dialog / DNS / Resolver / Recursion section, either turn off recursion completely if you don't need it, or limit it to your own IP address range(s):

Then, in the Lame Requests section, select either "Respond with a Refused error message" or "Do not respond":

Generally we recommend using the "Refused" option as this makes it easier to troubleshoot other DNS issues. However if this attack is continuously hitting your server, you will do the victim a favor using the "Do not respond" option. When no longer under attack, you can switch to the "Refused" option which still ensures that your server is not attractive as a way-point for this type of attack - since it won't amplify traffic.

If the requests are mostly for <root>, another way to deal with this traffic, and keep it out of the log at the same time, is the "Ignore all DNS requests for <root>" feature found in the Miscellaneous section:

Simple Failover v. 2.0

Sat, 31 Jul 2010 15:20:00 GMT

We are working on the next major version of Simple Failover, and we would like to hear your feedback on the planned new features. There is also still time for adding more new features if you have a good idea.

See the list of new features at http://www.simplefailover.com/kb.aspx?kbid=1298

Simple Failover is a software product which continuously monitors your servers (any networked device/service) to see which are up and which are down, and then dynamically updates your DNS records accordingly so that your domain name always points to a functional server. Additionally it can notify you of any encountered problems.

This upcoming v. 2.0 will of course be covered by our one year free upgrade protection. If you purchase a license for the current Simple Failover version today, you will receive a free upgrade to v. 2.0 when this is released.

Please e-mail us your thoughts and ideas, or post below, or in the all new community forums
We look forward to hearing from you.

Simple DNS Plus v. 5.2 build 117 released / Problem resolving WebMD.com

Fri, 09 Jul 2010 14:12:00 GMT

Simple DNS Plus v. 5.2 build 117 is now available at http://www.simpledns.com/download.aspx
For more details on the updates and changes in this build, please see release notes.

Over the last few days, several users have reported not being able to resolve www.webmd.com.
The problem is an erroneous response (details below) from the DNS servers hosting the domain name.
We have contacted WebMD.com and their DNS provider (UltraDNS) about this and anticipate that they will fix the problem shortly.
However since WebMD.com is a very popular web-site (and UltraDNS is one of the larger DNS providers), we felt it was best to provide a quick workaround with above update to Simple DNS Plus.

When we do a lookup for www.webmd.com against one of the authoritative DNS servers (for example "pdns1.ultradns.net"), we get a response with a CNAME-record (alias) pointing to www.phx1.webmd.com and a SOA-record in the authority section:

The standard (RFC) interpretation of this SOA-record is that no records exist for the current name (www.phx1.webmd.com) and the requested record type (A) - a so called "NO DATA" response.
Therefore previous builds of Simple DNS Plus naturally stopped the resolving process here - no need to do anything more since we know the final answer (no data).

However if we do another DNS lookup for www.phx1.webmd.com against the same DNS server, we get a surprising response - now all of a sudden there IS an A-record for this name:

This is an error in the configuration or operation of the DNS servers hosting www.webmd.com, and we obviously recommend that they get this fixed as quickly as possible.

In this new build of Simple DNS Plus, we have made an exception for this very specific situation:
For responses received containing a CNAME-record in the Answer section, a "NODATA" SOA-record in Authority section is now ignored, and the CNAME alias is attempted resolved in a new outbound request.
This immediately makes it possible for Simple DNS Plus to resolve www.webmd.com and any other domain with the same problem.
The trade off is that this will also cause a few more outbound requests in certain situations. These extra requests would normally not be necessary, but it does make Simple DNS Plus more resilient against this type of problem.

Expiration of support for Simple DNS Plus v. 4.00

Thu, 17 Dec 2009 13:16:00 GMT

Note that from January 17th 2010 we will no longer provide support for Simple DNS Plus v. 4.00 (or earlier versions).

As per our Support Life-Cycle Policy, a Simple DNS Plus version is supported for 3 years after it is first released, and for 2 years after we stop selling it (whichever comes last).
V. 4.00 was originally released on April 10th 2005, and we stopped selling it on January 17th 2008 when v. 5.0 was released.

We encourage users of v. 4.00 and earlier version to upgrade to the current v. 5.2.
For details on all the new features and other improvements see:
v. 5.0: http://www.simpledns.com/kb.aspx?kbid=1215
v. 5.1: http://www.simpledns.com/kb.aspx?kbid=1246
v .5.2: http://www.simpledns.com/kb.aspx?kbid=1265

Simple DNS Plus v. 5.2 build 116 / v. 5.1 build 138 released

Thu, 10 Dec 2009 23:57:00 GMT

Simple DNS Plus v. 5.2 build 116 is now available at http://www.simpledns.com/download.aspx
For details on the updates and changes in this build, please see release notes.

Simple DNS Plus v. 5.1 build 138 is now available at http://www.simpledns.com/download-oldver.aspx
For details on the updates and changes in this build, please see release notes.

These are NOT a critical updates. We do recommend that all users update to these builds, but there is no urgency unless you are directly affected by the issues addressed by the updates.

Update to the Simple DNS Plus API for .NET and COM

Fri, 30 Oct 2009 17:39:00 GMT

We have just released version 1.1 build 4 of the Simple DNS Plus API for .NET and COM.

Updates in this build:

Update: Uses Simple DNS Plus v. 5.2 code base (various optimizations and bug fixes).
Update: Setting Zone.DefaultTTL value now updates TTL value of all records which had the old default TTL value.
Update: Record TTL values now automatically synchronized in RRSet (records with same name / type) when adding new records.
Fixed: Setting DNSZone.AllowZoneTransfer property was not always saved correctly.

Version 1.1 build 4 is now available for download:
sdnsapi-setup.exe (720 KB)

If you have a previous version/build installed, simply run above installation file to upgrade.

For more information about the Simple DNS Plus API for .NET and COM, see the on-line documentation at http://www.simpledns.com/help/api/

Freeware DNS Client Library for .NET

Thu, 29 Oct 2009 11:55:00 GMT

We have just released "JH Software's DNS Client Library for .NET".

This can be used to perform simple as well as advanced DNS lookups from any .NET code (.NET v. 2.0 or later).

For details and download see http://www.simpledns.com/dns-client-lib.aspx

SPF checking HELO/EHLO host names

Fri, 16 Oct 2009 12:30:00 GMT

It has come to our attention that more e-mail servers are now performing SPF checks on the SMTP session HELO/EHLO greeting host name (in addition to checking the domain name part of the sender's e-mail address).

Therefore always make sure that your e-mail server is configured to use a correct host name (like "mail.example.com") in the HELO/EHLO greeting, and that an A- and/or AAAA-record exists for this host name in DNS.

Also, when using the "Automatic SPF" feature in Simple DNS Plus, make sure that the automatic SPF-record data is also valid for the HELO/EHLO host name, or define a specific SPF-record for the HELO/EHLO name in the zone where this belongs (this will override the automatic SPF record).

Note that the default automatic SPF record data "v=spf1 mx -all" will fail such a test if no MX-record exists for your HELO/EHLO name.
For example, if your domain name is "example.com" and your mail server is named "mail.example.com" (and uses this in HELO/EHLO greetings), you would probably only have an MX-record for "example.com" - not for "mail.example.com", and therefore "v=spf1 mx -all" fails to validate "mail.example.com".
Instead you could use "v=spf1 ip4:1.2.3.4 -all" (where 1.2.3.4 is the IP address of your mail server), which would work for both types of tests.

For more information about SPF in Simple DNS Plus, see KB1148.

New "Clone Response" plug-in

Thu, 20 Aug 2009 14:06:00 GMT

This new plug-in provides DNS responses by cloning the DNS records from responses to requests for another specified domain name.
This is an easy way to host many domain names that have the exact same records (except for their zone names).

For more details see KB1289.

Download cloneresponse-plugin.zip (9 KB) and un-zip it to the "plugins" sub-directory under the directory where Simple DNS Plus is installed. After this the plug-in will be available in the Simple DNS Plus Options dialog / Plug-Ins section.

Note that this plug-in requires an "unlimted zones" license and works with Simple DNS Plus v. 5.2 build 111 and later only.

New "TCP Port Forwarder" plug-in

Tue, 18 Aug 2009 11:47:00 GMT

This new plug-in provides simple TCP port forwarding.

If the Simple DNS Plus computer is connected to both the Internet and to a private network (LAN), this can be used to forward connections from the Internet to a computer on the LAN. For example mapping remote desktop connections (port 3389).

For more details see KB1288.

Download tcpforward-plugin.zip (18 KB) and un-zip it to the "plugins" sub-directory under the directory where Simple DNS Plus is installed. After this the plug-in will be available in the Simple DNS Plus Options dialog / Plug-Ins section.

Note that this plug-in works with Simple DNS Plus v. 5.2 and later only.

ns2service.net now supports secure zone transfers

Wed, 22 Jul 2009 11:56:00 GMT

Our secondary DNS service at www.ns2service.net now supports secure zone transfer (TSIG authenticated).

Both zone transfer requests and responses are authenticated, so this provides protection in two ways; it prevents unauthorized transfers (only people / servers with the correct key can transfer), and it ensures data integrity on the secondary servers (not possible to spoof / inject false data during transfers).

You can enable TSIG when adding or editing a domain name in the ns2service.net web interface.

For details on enabling/requiring TSIG signed zone transfers on your primary Simple DNS Plus server see http://www.simpledns.com/newsitem.aspx?id=2387

Updated "Remote DNS Look Up" function

Sun, 05 Jul 2009 15:18:00 GMT

Our on-line Remote DNS Look Up function has been updated to much closer match the features of the GUI based DNS Look Up tool that comes with Simple DNS Plus.

It now supports a long list of additional record types, it supports EDNS0 options including payload size and DNSSEC, and it supports displaying native characters in IDNs in the repose output.

The output is formatted the same way as in the GUI tool - in fact the on-line and GUI tools now shared much of their program code (both .NET based).

And finally the on-line function is now AJAX based for a smoother experience.

New DNS server IP addresses for ns2service.net

Fri, 03 Jul 2009 15:11:00 GMT

We are moving our ns2service.net DNS servers to new IP addresses:

ns.ns2service.net = 77.68.170.98
ns2.ns2service.net = 77.68.170.99

For ns2service.net users - If your primary DNS server is restricting zone transfer access by IP address, please update your configuration to include the IP addresses above.

You do NOT need to update your domain name registrations as our DNS server names are not changing.

GeoDNS plug-in for Simple DNS Plus

Mon, 22 Jun 2009 08:30:00 GMT

This new plug-in provides a different DNS response depending on what country a DNS request originates from. This can be used to direct Internet traffic (web, FTP, streaming media, etc.) to a server geographically closer to the end-user, or with contents specific for a geographical area.

This is exactly the same that large web-sites such as Google.com and CNN.com do, and what companies like Akamai charge a lot of money to provide.
Now this functionality is available as a free plug-in for Simple DNS Plus.

For more details see KB1284.

Download geodns-plugin.zip (31 KB) and un-zip it to the "plugins" sub-directory under the directory where Simple DNS Plus is installed. After this the plug-in will be available in the Simple DNS Plus Options dialog / Plug-Ins section.

Note that this plug-in works with Simple DNS Plus v. 5.2 and later only.

Simple DNS Plus v. 5.2.105 / 5.1.136 / 5.0.125 released

Thu, 21 May 2009 10:56:00 GMT

Simple DNS Plus v. 5.2 build 105 is now available at http://www.simpledns.com/download.aspx
For details on the updates and changes in this build, please see release notes.

Simple DNS Plus v. 5.1 build 136 is now available at http://www.simpledns.com/download-oldver.aspx
For details on the updates and changes in this build, please see release notes.

Simple DNS Plus v. 5.0 build 125 is now available at http://www.simpledns.com/download-oldver.aspx
For details on the updates and changes in this build, please see release notes.

These are NOT a critical updates. We do recommend that all users update to these builds, but there is no urgency unless you are directly affected by the issues addressed by the updates.

DNS Blacklist Editor v. 1.0 build 4 released

Mon, 18 May 2009 11:16:00 GMT

When compiling lists for the Simple DNS Plus DNSBL plug-in, a bug related to exclusions caused some IP address ranges to be listed which should not be.

The new build of the editor is now available from http://www.simpledns.com/dnsbl-editor.aspx
This build is now also included with the DNSBL plug-in download.

Simple DNS Plus logs in W3C Extended format

Mon, 04 May 2009 13:49:00 GMT

A new command line tool which converts Simple DNS Plus raw request log files (.sdraw files) into the standard W3C Extended log file format (as typically produced by IIS, Apache, and other web-servers) is now available.

Note that DNS request (and the .sdraw log files) do not contain HTTP header information such as referrers, browser info, full URLs, etc. So while you can process the resulting W3C log files with various web-log analyzer programs, this does not replace web-logs.
Rather it provides a different perspective on traffic data.
Data columns shared with web-server logs are "date", "time", "c-ip" and "cs-host". Additional "x-" columns contain more details about individual DNS requests.

Click here to download "sdraw-w3c.zip" (35 KB)

The zip file above contains both the compiled "sdraw-w3c.exe" file as well as the C# source code (VS2008).
This is a very small and simple program so if you want to add some type of filtering (only output some requests) or build on this functionality, it is easy to do so.

The command line syntax is:
sdraw-w3c.exe <log-date> <raw-log-file> <w3c-log-file>

Raw request log files are enabled in the Simple DNS Plus Options dialog / Logging / Log Files section.

Thanks to "Fulgan" for suggesting this in our community forum.

Simple DNS Plus v. 5.2 released

Thu, 23 Apr 2009 13:18:00 GMT

Some of the new features in Simple DNS Plus v. 5.2 are:

- Remote Management
- Runs on Windows "Server Core"
- DNSSEC
- Secure Zone Transfers
- Check Internet Delegations wizard
- Windows Performance Counters
- And much more...

See all the details at http://www.simpledns.com/kb.aspx?kbid=1265

IMPORTANT: Version 5.2 may or may not be a free upgrade depending on when you purchased your license or last purchased an upgrade.
If you purchased your license or your last upgrade on or after April 23rd 2008, then the upgrade to v. 5.2 is free.
Otherwise you will need to purchase an upgrade - see http://www.simpledns.com/upgrade.aspx

V. 5.2 is now available for download at http://www.simpledns.com/download.aspx
Please read the important upgrade instructions on the same page.

Simple DNS Plus v. 5.1 build 135 released

Wed, 22 Apr 2009 09:57:00 GMT

Simple DNS Plus v. 5.1 build 135 is now available at http://www.simpledns.com/download.aspx

For details on the updates and changes in this build, please see release notes.

This is NOT a critical update. We do recommend that all users update to this build, but there is no urgency unless you are directly affected by the issues addressed by this update.

Secure zone transfers in Simple DNS Plus v. 5.2

Tue, 17 Mar 2009 20:38:00 GMT

The upcoming Simple DNS Plus v. 5.2 supports secure zone transfer (TSIG authenticated).
Both zone transfer requests and responses are authenticated, so this provides protection in two ways; it prevents unauthorized transfers (only people / servers with the correct key can transfer), and it ensures data integrity on secondary servers (not possible to spoof / inject false data during transfers).

In the Zone Properties dialog, you can now specify the TSIG key(s) which are allowed to transfer the zone:

For each key, you specify a key name, signing algorithm, and a secret:

For secondary zones, you can now specify the key to sign zone transfer requests with:

In the Options dialog / DNS / Local Zones / Zone Transfers section, it is now also possible to specify keys which are allowed to transfer all zones:

And in the Options dialog / DNS / Local Zones / Super Master/Slave section, it is now possible to allow / disallow un-signed zone transfer requests from slave server - and to specify keys for master servers:

Adding / editing a master server:

This new feature is available in Simple DNS Plus v. 5.2 BETA build 25 and later - now available at http://www.simpledns.com/beta.aspx

For other updates in this BETA build, please see the beta release notes

New build of the Simple DNS Plus API for .NET and COM

Wed, 04 Mar 2009 12:45:00 GMT

The Simple DNS Plus API for .NET and COM version 1.1 build 3 is now available for download from http://www.simpledns.com/addons.aspx

The purpose of this build is to fix some .NET compatibility issues on computers with .NET Framework 3.5 installed.
This build does not contain any changes to the API functions.

Simple DNS Plus on Windows "Server Core"

Tue, 17 Feb 2009 18:12:00 GMT

The upcoming Simple DNS Plus v. 5.2 also runs on Windows "Server Core".
For details see KB1278.

To download the current beta and for more information about beta testing see http://www.simpledns.com/beta.aspx

DNSSEC signed .gov

Thu, 05 Feb 2009 13:28:00 GMT

Today the .gov top level domain (U.S. government) was DNSSEC signed.
As per OMB Memo 08-23, all U.S. government agencies must DNSSEC sign their DNS zones (ending with .gov) before the end of 2009.

Federal agencies using Simple DNS Plus will be able to DNSSEC sign their zones in the upcoming Simple DNS Plus v. 5.2 (beta version available now). For details see:
- How to DNSSEC sign a zone with Simple DNS Plus
- Managing DNSSEC keys with Simple DNS Plus

Using the DNS Look Up tool in Simple DNS Plus 5.2, we can see that the ".gov" zone was indeed signed on February 5th 2009 at 12:01:02 PM (UTC):

And using the Check DNSSEC Signatures tool (free download), we can verify that the .gov zone's records are signed correctly:

Option in Simple DNS Plus to ignore root requests

Sat, 31 Jan 2009 13:48:00 GMT

Because of continued reports about DNS amplification / DDoS attacks (DNS requests for NS-records for <root> from spoofed IP addresses), we have added a new option in Simple DNS Plus to make it easy to deal with these requests and keep them out of the log.

In the Simple DNS Plus Options dialog / DNS / Miscellanuous section, there is now a new "Ignore all DNS requests for <root>" option:

And the statistics (available through the HTTP API) has a new counter for this:

This new option is in Simple DNS Plus v. 5.1 build 128 now available at http://www.simpledns.com/download.aspx

Please note that this only works against a very specific type of attack - which has been rampant for the last two weeks or so. It may become useless very quickly if the attackers change their tatics, but at least it should help right now.

IMPORTANT: When registering new domain names, some registrars require that your DNS server responds with a correct list of DNS root servers as part of their tests, so you may need to temporarily switch this option off when doing this.