Dynamic Host Configuration Protocol (DHCP) Domain Search Option
Extracted elements (14)
DNS name compression (RFC 1035 section 4.1.4) was chosen for encoding the searchlist because DHCP option space is limited and domain searchlists are likely to contain repeated instances of the same domain name, making compression both useful and likely to be effective.
If the length of the domain searchlist exceeds the maximum permissible within a single option (255 octets), then multiple Domain Search Options MAY be used as described in RFC 3396 (Encoding Long Options in DHCPv4). The client must concatenate all such options before interpreting them.
Domain search option implementations MAY require DHCP authentication (RFC 3118) prior to accepting a domain search option, as a mitigation against rogue DHCP server attacks.
Hosts implementing the domain search option SHOULD also implement the searchlist recommendations of RFC 1536 section 6, including using searchlists only when explicitly specified and resolving names with dots as FQDNs first.
If multiple Domain Search Options are present, the data portions of all options are concatenated together as specified in RFC 3396, and compression pointers indicate offsets within the complete aggregate block of data.
If the receiver is part-way through decoding a search domain name when it reaches the end of the complete aggregated block without finding a zero or a valid two-octet compression pointer, the partially read name MUST be discarded as invalid.
Searchstrings in the searchlist MUST be concatenated and encoded using the DNS name compression technique described in RFC 1035 section 4.1.4, where an entire domain name or list of labels at the end of a domain name may be replaced with a pointer to a prior occurrence of the same name.
Where DNS parameters such as the domain searchlist or DNS servers have been manually configured, these parameters SHOULD NOT be overridden by DHCP.
Every search domain name in the encoded searchlist must end either with a zero (null root label) marking the end of the name, or with a two-octet compression pointer referencing a prior occurrence of the remaining labels.
The DHCP Domain Search Option (option code 119) is passed from the DHCP Server to the DHCP Client to specify the domain search list used when resolving hostnames with DNS. It applies only to DNS and not to other name resolution mechanisms.
IANA has assigned DHCP option code 119 to the Domain Search Option defined in this document.
A rogue DHCP server could use the domain search option to redirect traffic: a user requesting 'myhost' expecting 'myhost.bigco.com' might instead reach 'myhost.roguedomain.com'. DNSSEC does not avert this attack since the rogue domain's records may be legitimately signed, making this a more fruitful attack avenue than providing an illegitimate DNS server option.
The compression pointer within the Domain Search Option refers to the offset within the data portion of the DHCP option, not including the preceding option code byte or option length byte. When multiple Domain Search Options are present, the pointer indicates an offset within the complete aggregated block of data.
The Domain Search Option has a 1-byte code field (value 119), a 1-byte Len field, and a variable-length Searchstring field containing the encoded domain search list. If the searchlist exceeds 255 octets, multiple options MAY be used per RFC 3396.