Fwd: Improperly configured DNS servers for gnu.org and fsf.org

[Paul Eggert]

Who's in charge of the DNS servers for gnu.org and fsf.org? I'd like to 
forward the attached message to them. Thanks.

--- Begin Message --- Subject: Improperly configured DNS servers for gnu.org and fsf.org Date: Mon, 5 Apr 2021 08:00:00 -0400

Hi there,

My name is Bill Demirkapi and I am an independent security researcher. I
was bored last night so for funsies I decided to test the nameservers of
the top 500k Alexa domains. I tried querying each domain's nameservers with
AXFR <https://tools.ietf.org/html/rfc5936> queries when I was shocked to
see "gnu.org" as a vulnerable domain.

It seems like a partial misconfiguration because your primary nameserver
ns1.gnu.org refuses AXFR queries but all the other ones (ns2, ns3 (same as
ns2), and ns4) were more than happy to send over the zone for "gnu.org".
Also, I checked "fsf.org" and unfortunately all of its nameservers were
vulnerable to AXFR queries too.

I would recommend reviewing the configuration for all of your DNS servers
to check for any other potential mistakes as well. Attached is what I was
able to extract. Let me know if I can help!

Best regards,
Bill Demirkapi
Independent Security Researcher
https://billdemirkapi.me

gnu.org.zone.txt
Description: Text document

fsf.org.zone.txt
Description: Text document

--- End Message ---