SCALE: finding RFC-compliance bugs in DNS nameservers
SCALE builds an executable model of how DNS resolution is supposed to work, then uses symbolic execution to generate tiny zone files paired with queries that are likely to make implementations disagree. Run against real authoritative servers (that's the Ferret tool), it surfaced dozens of cases where popular nameservers answer the same query differently — so at least one of them is wrong about the RFCs. What I like is that the oracle is simply "servers should agree", which needs no ground-truth labels.
Paper: NSDI 2022
404 views