Passive DNS Exchange

Mission

This group works to define a common output format of Passive DNS Servers which clients can query. Over time, since the initial announcement of Passive DNS replication at the 17^th Annual FIRST Conference on Computer Security by Florian Weimer, multiple Passive DNS Implementations were developed. This standard proposes a common output format to make Passive DNS information more universally useable.

Goals/Deliverables

The initial goal of this SIG was to collaboratively develop a common output format (COF) for Passive DNS data. As a result of this SIG, an Internet Draft was published on September 9^th 2014.

The lastest version can be found on the IETF site. The source code of the standard can be found on github. Change requests or discussions are welcome on github or on the mailing list.

Code

Apart from definining the standard, farsight and the group added a MISP module called cof2misp which can import COF into MISP. There, the full power of the MISP correlation engine can be employed to find matching indicators of compromise. Therefore, by importing the COF format into MISP, we can pivot back and forth between passive DNS databases and MISP.

If you want to try out the cof2MISP module and if you are a member of FIRST, the https://misp.first.org instance has the cof2MISP module installed, and you can try correlating events. If you need to get access to passive DNS DB servers, you can ask:

CIRCL.lu
farsight (which is the largest passive DNS database operatore to the best of the author's knowledge)
- obtaining keys from Farsight Security
... or any of the other passive DNS server operators.

Status quo

the silence procedure for the draft ended by May 19th, 2021. We are now ready to submit to the IETF WG.

Next steps

bringing it into the standards track.
specify a query format (client to pDNS server) common format (RESTful API specs)

Authors

Alexandre Dulaunoy (alexandre.dulaunoy@circl.lu)
Aaron Kaplan (aaron@lo-res.org)
Paul Vixie (paul@redbarn.org)

Request to Join