Re: Collecting PTR names or IP addresses (Was: Re: IRC Bot list (cross posting))

[Gadi Evron <gadi () tehila gov il>]

>         PTR records are just as pointless as A records...
>         in a secured DNS heirarchy, this is less of an issue

We are not quite there yet, are we?

>         since you have to spoof the entire delegation chain.
>         so either trust the DNS (both forward and reverse)
>         or not.  For forensics, collect the DNS lables and the
>         IP addresses associated w/ them.
>
>         and yes, i have seen DNS spoofing in the wild, both A
>         and PTR, although A spoofing is much more pronounced.

Question is, why bother and spoof?