They're actually easier at the subdomain level, because you can keep asking for <rand>._dv.example.com to prevent cache hits, all the while spamming back NS delegation answers for _dv to the cache servers with a long TTL.
DNSSEC of course solves that, but a lot of people are going to roll their eyes at that solution and a lot of things don't support it.
They're actually easier at the subdomain level, because you can keep asking for <rand>._dv.example.com to prevent cache hits, all the while spamming back NS delegation answers for _dv to the cache servers with a long TTL.
DNSSEC of course solves that, but a lot of people are going to roll their eyes at that solution and a lot of things don't support it.
Just curious.