Comment Move the SOA (Score 1) 395
The next issue is who and where should the SOA be published from?
This is potentially a bad thing, as suppose someone attacks you from IP address 1.2.3.4. And for some reason, reverse DNS on that IP address fails to work. If there is more than one system tracking ownership of who currently has the right to use this IP address, how do you find the right administrator to contact? And what if someone updated their contact information or the fact the IP block had been sold in one system, but forgot to do so in another?
There is another layer that is not discussed in TFA that uses whois and routing announcements to help verify routing. Routing databases like RADB are required by most BGP transit providers and all peering exchanges will use something like peerdb.com to help track their members too. The transit providers like to know where to send the bill for the bandwidth used by an IP block and peering exchanges like to enforce their rules. IP blocks are assigned to people and companies that can change locations and providers. In the attack scenario if a PRT record for the IP was not found, search for the nameserver of the reverse zone, if that is missing do a traceroute and pick the previous hop to report to the IP's provider. All Datacenter/network providers have a no abuse/spam clause in their contracts where they can disable/terminate service.
The reality is that no one can buy an IP address. They are all leased from the RIRs and IANA. The RIRs can ask for the IPs back at anytime.
BTW 192.0.2.0/24 is the IP block for examples..
"When people are least sure, they are often most dogmatic." -- John Kenneth Galbraith