We are not saying it is DNS. We are asking the questions nobody else will ask. Follow the evidence. Follow the TTLs. Follow the money.
Raw findings. Unverified. Uncomfortable. We pin them here for the public record, before someone "updates the zone file."
The port number is 53. Fifty-three. A prime number. Look up what else is "prime." Ask yourself why.
RFC 1034 was published in November 1987. The stock market crashed the month prior. No one has ever explained this convergence.
— coincidence???AWS Route 53. Route 66 is famous, celebrated, songs are sung. Route 53 is silent. Hidden in plain sight.
Have you EVER seen a DNS engineer look genuinely surprised when something breaks? They know. They have always known.
"DNS" contains an N. So does "NSA." So does "NTP," "DHCP," and "LAN." I'm not saying. I'm asking.
Try explaining DNS to a non-technical person. Did they believe you? Would YOU believe you?
wake upSubmitted to the IETF. Submitted to ICANN. Submitted to an unnamed contact. No reply.
Obtained through channels we are not at liberty to disclose. Authenticity: unconfirmed. Implications: enormous.
TO: ████████████
FROM: █████████, ARPA
Per our conversation of ████, the resolver behavior shall be configured to ██████████████████. Public documentation will describe it as ██████████. At no point shall the true ████████████ be disclosed.
Burn after reading. Or cache it. Whichever serves.
Abstract: █████████████████████████████████████████████████ █████████████████████, which, given the observed TTL behavior, ██████████████████.
This draft expires in ██ seconds. Do not redistribute. Do not cache. Do not ask.
> they're onto us
>
> fall back to TCP
understood. extending the TTL. buying us time.
— message redacted by sender, 3 minutes after sending —
Protocols and technologies frequently sighted in the vicinity of incidents. Guilt by association is, admittedly, guilt.
Hands out IP addresses like candy. Always on the scene. Claims ignorance. Suspicious.
Capable of rerouting anyone, anywhere, on short notice. Leaves no forwarding address.
Hides identities for a living. Has been doing this for decades. Enough said.
Claims to know "what time it is." Who appointed NTP timekeeper? How convenient, those timestamps.
Documented incidents. Each attributed, officially, to "DNS." Each, we contend, merely attributed.
Seen suspicious TTL activity? Noticed a resolver behaving irregularly? A colleague insisting "it can't be DNS"? Your anonymity is guaranteed.*
* Anonymity is not actually guaranteed. Nothing is guaranteed. Especially not DNS.
When the oracle foretells it, and the diagnostician confirms it, we will still be here — pinning index cards to a wall, asking who, asking why, asking at what TTL.