Remediating new DNSSEC resource exhaustion vulnerabilities

What this post added

This post details the mitigation of two DNSSEC vulnerabilities, CVE-2023-50387 (Keytrap) and CVE-2023-50868 (NSEC3 iteration and closest encloser proof). For Keytrap, Cloudflare implemented signature validation limits per RRSET and a total signature validation limit per resolution task, failing queries that exceed these limits with EDE code 0. For NSEC3, a limit for total hash calculations per resolution task was added, failing queries with EDE code 27. Both mitigations include new metrics for attack detection. The post also outlines the timeline of patching for Cloudflare's public resolver (1.1.1.1) and internal resolvers.