Edward Lewis wrote:
Cache poisoning was "solved" by the trustworthiness rules and other
clean up in RFC 2181. Cache poisoning is still a vulnerability but
much harder and less effective if the caches in the pipeline all
implement RFC 2181 rules cleanly.
I agree that the cache poisoning problem has been solved, for most
practical purposes, by caching servers implementing anti-poisoning
rules.
However, I must point out that the specific rules in RFC2181 are in
fact not an effective defense against cache poisoning, and that the
immunity against poisoning enjoyed by current caching servers stems
from a completely different rule that is still not stated in any IETF
document.
There are several variations of this rule, but in its simplest form,
it says that when a caching server queries the authoritative servers
of a given domain, it must discard all response records whose owner
name is outside that domain.