  We present practical poisoning and name-server block- ing attacks on standard
DNS resolvers, by off-path, spoofing adversaries. Our attacks exploit large DNS
responses that cause IP fragmentation; such long re- sponses are increasingly
common, mainly due to the use of DNSSEC. In common scenarios, where DNSSEC is
partially or incorrectly deployed, our poisoning attacks allow 'com- plete'
domain hijacking. When DNSSEC is fully de- ployed, attacker can force use of
fake name server; we show exploits of this allowing off-path traffic analy- sis
and covert channel. When using NSEC3 opt-out, attacker can also create fake
subdomains, circumvent- ing same origin restrictions. Our attacks circumvent
resolver-side defenses, e.g., port randomisation, IP ran- domisation and query
randomisation. The (new) name server (NS) blocking attacks force re- solver to
use specific name server. This attack allows Degradation of Service,
traffic-analysis and covert chan- nel, and also facilitates DNS poisoning. We
validated the attacks using standard resolver soft- ware and standard DNS name
servers and zones, e.g., org.
