AINEWS
An early 2000s plan to route phone calls over the internet was abandoned, but an orphaned subdomain of it was still answering live queries about US military bases.
"It's basically completely dead." That is the official status of e164.arpa, an early-2000s RFC idea to route phone calls over the internet using the domain-name system. But a security researcher who recently registered an orphaned e164.arpa subdomain as a small act of curiosity received hundreds of thousands of live call-routing queries from real carriers. A large share of those queries pointed to US military bases. The calls were not intercepted. The routing records were logged by an unauthorized third party, because the underlying infrastructure had no owner and no enforcement. The carriers, the IETF, and the national registries that run e164.arpa have not said who is responsible for closing that gap.
The plan behind e164.arpa was simple. Take a phone number, reverse its digits, separate them with dots, and append .e164.arpa at the end. The string becomes a domain name, and the global phone network can look up a routing record the same way the internet looks up a website. A European caller dialing a number in the US would never touch the traditional phone switch. The call would be sent, instead, to a SIP or VoIP endpoint published in DNS.
The system was called ENUM, and the .arpa suffix was a tell. .arpa is a top-level domain reserved by the internet's standards body for technical infrastructure that is too important to live in the regular domain name system. The reverse-DNS zones that map IP addresses back to names live there. The zone that ENUM was meant to use lived there too. RFCs say only one kind of record, NAPTR, is allowed on .arpa at all.
Public ENUM is, as the security researcher Lina put it in her writeup, "basically completely dead." But the underlying machinery kept running. Each country controls its own e164.arpa subtree: in Germany, DENIC runs .9.4.e164.arpa for the +49 country code. When a carrier still needs to ask whether a phone number has been ported, or which network actually serves it, it can still send a NAPTR query into the relevant country's zone. The zones have not been retired. They have been left, in many cases, unmonitored.
That is the gap Lina walked into. She registered a domain under the +49 zone and, by extension, took over the routing of calls for entire territories that the zone was supposed to cover. Within days, her servers were answering live queries from real carriers. A large share of those queries, she reports, resolved to US military bases. She did not decrypt or record the calls. The carriers' routing records were received by the researcher.
"DNS hijacking is silly," Lina wrote. The failure is institutional, not technical. Nobody broke into the phone network. Nobody impersonated a base. The network asked an open question, and the open question had no designated answer. The right answer, in many of these cases, was nowhere at all.
ENUM was abandoned as a project, but the zones that hold it are still in production. The carriers that still issue queries have a list of which subzones are supposed to answer. The IETF, which owns .arpa and the RFCs that govern it, has a process for marking protocols historical. DENIC, which runs the German subtree, has a delegation policy. None of those bodies have a public process for "this zone is still resolving, but no one is supposed to be sending it traffic." A comment on the Hacker News thread about Lina's post, from a network engineer, notes that private ENUM services still exist behind VPNs, used for number-porting and least-cost routing. The phone network has not forgotten about e164.arpa. It has just stopped saying so out loud.
The calls were logged, not intercepted. The researcher disclosed. The RFCs say only NAPTR records should ever live on .arpa. Members of the certificate authority community have argued, separately, for stopping the issuance of TLS certificates for .arpa at all, on the grounds that infrastructure domains should not be reachable over HTTPS. That argument now has a concrete case behind it.
The researcher did not find a vulnerability. She found a door. The door had a sign that said "do not enter." It did not have a lock.