Top all-time · #6390
Infoblox
Company blog · infoblox.com/blogsecuritysystems
Infoblox is the company blog at infoblox.com, writing about security and systems. Since 2008, 13 different Hacker News readers have linked it 15 times, most often “Abusing .arpa, the TLD that isn't supposed to host anything”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link Infoblox's DNS security resource center and blog as references on DNS security, DNS response rate limiting, IPv6 prefix sizing and threat intelligence.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Infoblox's DDI platform unites networking, security and cloud to seamlessly integrate, automate and secure critical network services across your environments.
Most-linked posts?
- Abusing .arpa, the TLD that isn't supposed to host anything3 people · 3 mentions · first linked 2026-03-09
What Hacker News says?
Put the checksums in a separate system such as the DNS. Use DNSSEC on your domains. Manage your DNS system as an isolated system (don't mix your HTTP/Email/Other stuff with your DNS provider). Now, users may verify the downloads you provide at your website by getting checksums from the DNS. DANE may be of interest here as well: https://www.infoblox.com/dns-security-resource-center/dns-se...
Comment linking /dns-security-resource-center/dns-security-faq/what-is-dane/
on “Google Ad Disguising Itself as www.gimp.org”Submitted The Underground Market That Unlocks Stolen iPhones as a story · 2 points
HN discussionDo I understand this correctly on a semantic level as "MAC address for the Internet"? (Or, in so many words: an alternative for dynamic DNS without a centralized/hierarchical lookup infrastructure that punches through NATs without all the associated hassle). I.e., the problem is "communicate directly with a node on the Internet by its unique ID". The big question is: what do you solve that Kademlia (BitTorrent) does…
Comment linking /blog/ipv6-coe/you-thought-there-was-no-nat-for-ipv6-but-nat-still-exists/
on “Iroh 1.0”Submitted A Malicious Push Network: What 57M Logs Taught Us as a story · 2 points
HN discussionThat's an excellent question! When I was writing that I was pretty deep in DNS code and standards I think I just understood that as a rule of DNS. Or at the least, I believed I understood. Looking back a decade later I can't find any standard which supports my statement. However lots of other secondary sources seem to agree with me. "In these situations, the client needs to re-transmit over TCP for which the size li…
Comment linking /dns-security-resource-center/dns-security-faq/is-dns-tcp-or-udp-port-53/
on “How many IP addresses can a DNS query return? (2015)”Submitted Amusing Numerology: How Base-5 Domain Numbers Reveal a Single Hidden Campaign as a story · 1 points
HN discussionunless I misunderstood something, what I am talking about is response rate limiting [1]. It can help with defending against DNS amplification attacks [2] [1] https://www.infoblox.com/dns-security-resource-center/dns-se... [2] https://kb.isc.org/docs/aa-01000
Comment linking /dns-security-resource-center/dns-security-solutions/dns-security-solutions-response-rate-limiting-rrl/
on “Shutting down our unencrypted public DNS service”Submitted Abusing .arpa, the TLD that isn't supposed to host anything as a story · 1 points
HN discussionI have not had a deal with this, but if I was going to, I would start at the /64 and move up by nibble (4-bit) boundaries: /64, /60, /56, /52, /48. /56 is often recommended as the minimum as for a (residential) customer. /48 is considered a "site" address prefix, and is the smallest allocation that can be advertised in BGP: * https://blog.apnic.net/2020/06/01/why-is-a-48-the-recommende... * https://www.infoblox.com/…
Comment linking /blog/ipv6-coe/a-48-for-every-site-and-for-every-site-a-48/
on “IPv6 Traffic Crosses the 50% Mark for the First Time”Submitted Abusing .arpa, the TLD that isn't supposed to host anything as a story · 1 points
HN discussionUpdated Date: 2026-03-11T07:13:31Z Creation Date: 2001-03-09T23:23:30Z Registry Expiry Date: 2027-03-09T23:23:30Z There is also this: https://www.infoblox.com/blog/threat-intelligence/abusing-ar...
Comment linking /blog/threat-intelligence/abusing-arpa-the-tld-that-isnt-supposed-to-host-anything/
on “Hurricane Electric (HE.NET) IPv6 tunnelbroker page offline due to expired domain”Submitted Scaling the Fraud Economy: Pig Butchering as a Service as a story · 1 points
HN discussionSubmitted Infoblox DNS Threat Index as a story · 1 points
HN discussionSubmitted BloxNews highlights Infoblox Cisco and Infrastructure 2.0 as a story · 1 points
HN discussionSubmitted BloxNews (Nov) contains Cricket Liu on DNSSEC as a story · 1 points
HN discussion
