<p>There are some differences between DNS seeding and the IRC method. IRC used to function as a meeting point; essentially a centralized broadcast system to let (all) other nodes know about your existance, but it failed to answer the query "who is online now?". This means that when using IRC as a publically reachable node, you would often see a peak of incoming connections quickly, but little activity afterwards. Obviously, it was also vulnerable to DOS attacks as a centralized point of failure.</p>

<p>DNS seeds are much more intended to work as seeds: they provide nodes with a few reliable entry points into the network, but let the actual discovery of new nodes be done by the network itself (peers exchange other peer's IP addresses). Futhermore, the DNS system is capable of server much larger numbers of nodes. </p>

<p>To answer your actual question: the DNS servers themselves may be be vulnerable to attacks, but it is important to realize that they are far less essential to the network than IRC was. Also, the 4 active DNS seeds are operated by different people, and managed quite differently:</p>

<ul>
<li>Jeff's node (<code>bitseed.xf2.org</code>), is currently a static list, updated mostly manually and infrequently, but hosted very reliably.</li>
<li>Matt's node (<code>dnsseed.bluematt.me</code>), is served by a BIND server (typical DNS server software), which is fed a fresh list of reliable nodes by a crawler every few minutes or seconds.</li>
<li>Luke's (<code>dnsseed.bitcoin.dashjr.org</code>) and my node (<code>seed.bitcoin.sipa.be</code>) run a custom DNS server+crawler system, which reports a random set of reliable nodes for each query.</li>
</ul>

<p>One further remark on your question: the DNS seeding system was introduced in v0.3.21 (april 2011), and turned on by default in v0.3.24 (juli 2011). Since 0.6.0 (march 2012), IRC seeding is off by default. As of 0.8.2 (not yet released), IRC support will be removed entirely.</p>

CC BY-SA 3.0
2013-01-04T22:31:15.730Z
Any idea why bitcoin didn't opt for STUN//TURN/ICE? Seems like it would remove the complications involved with firewalls and such. Opening the world up to more peers. http://www.webrtc.org/reference/architecture#TOC-STUN-ICE
Kevin Peno
CC BY-SA 3.0
2014-08-07T23:20:00.833Z
Does it use DNSSEC?
Manish
CC BY-SA 3.0
2012-05-02T23:36:06.257Z
2013-04-28T17:41:25.643Z
2013-04-28T17:41:25.643Z
Pieter Wuille
<p>With the version 0.6, Bitcoin introduced the DNS servers that populate the initial peers for new clients. How secure are those servers in terms of being immune to takedown attacks, or injection of malicious data?</p>

CC BY-SA 3.0
2012-05-02T05:29:49.340Z
It doesn't matter that much since this is one seed method among several and an attacker would have to control *all* 8 of your outbound connections to cause you harm. So far as I know, the provided DNS seeds weren't audited for security against attacks from the outside but just were provided by people who were themselves trustworthy and who were able to offer the service. For example, one is run by [Vladimir Marchenko](http://bitcoinmagazine.co.uk/team-view/vladimir-marchenko/).
David Schwartz
CC BY-SA 3.0
2012-05-05T01:40:32.207Z
Vladimir did run a DNS seed, but it was removed from bitcoind's source code in october 2011 (at his request). See my post below for more details.
Pieter Wuille
<bitcoin-core><security><dns><peer-discovery>
How secure are the DNS servers for Bitcoin?
ThePiachu
# How secure are the DNS servers for Bitcoin?

(Asked by: username_0 on 2012-05-01)

With the version 0.6, Bitcoin introduced the DNS servers that populate the initial peers for new clients. How secure are those servers in terms of being immune to takedown attacks, or injection of malicious data?

**Tags:** bitcoin-core, security, dns, peer-discovery

> **Comments:**
> **username_1**: It doesn't matter that much since this is one seed method among several and an attacker would have to control *all* 8 of your outbound connections to cause you harm. So far as I know, the provided DNS seeds weren't audited for security against attacks from the outside but just were provided by people who were themselves trustworthy and who were able to offer the service. For example, one is run by [Vladimir Marchenko](http://bitcoinmagazine.co.uk/team-view/vladimir-marchenko/).  
> **username_2**: Vladimir did run a DNS seed, but it was removed from bitcoind's source code in october 2011 (at his request). See my post below for more details.  

---

## 1 answers

### Answer by username_2 on 2012-05-02. Score: 9 | Accepted answer

There are some differences between DNS seeding and the IRC method. IRC used to function as a meeting point; essentially a centralized broadcast system to let (all) other nodes know about your existance, but it failed to answer the query "who is online now?". This means that when using IRC as a publically reachable node, you would often see a peak of incoming connections quickly, but little activity afterwards. Obviously, it was also vulnerable to DOS attacks as a centralized point of failure.

DNS seeds are much more intended to work as seeds: they provide nodes with a few reliable entry points into the network, but let the actual discovery of new nodes be done by the network itself (peers exchange other peer's IP addresses). Futhermore, the DNS system is capable of server much larger numbers of nodes.

To answer your actual question: the DNS servers themselves may be be vulnerable to attacks, but it is important to realize that they are far less essential to the network than IRC was. Also, the 4 active DNS seeds are operated by different people, and managed quite differently:

* Jeff's node (`bitseed.xf2.org`), is currently a static list, updated mostly manually and infrequently, but hosted very reliably.
* Matt's node (`dnsseed.bluematt.me`), is served by a BIND server (typical DNS server software), which is fed a fresh list of reliable nodes by a crawler every few minutes or seconds.
* Luke's (`dnsseed.bitcoin.dashjr.org`) and my node (`seed.bitcoin.sipa.be`) run a custom DNS server+crawler system, which reports a random set of reliable nodes for each query.

One further remark on your question: the DNS seeding system was introduced in v0.3.21 (april 2011), and turned on by default in v0.3.24 (juli 2011). Since 0.6.0 (march 2012), IRC seeding is off by default. As of 0.8.2 (not yet released), IRC support will be removed entirely.

> **Comments:**
> **username_3**: Any idea why bitcoin didn't opt for STUN//TURN/ICE? Seems like it would remove the complications involved with firewalls and such. Opening the world up to more peers. http://www.webrtc.org/reference/architecture#TOC-STUN-ICE  
> **username_4**: Does it use DNSSEC?  

---

