RCS and DNS: The NAPTR Record, (Mon, Jul 6th)

This article details the observation of NAPTR records being utilized in RCS (Rich Communication Services) communications, specifically within Verizon’s network. NAPTR records, defined in RFC 2915, are typically used to return URIs instead of IP addresses. In this case, the records are being used to facilitate secure SIP over TCP communication (SIPS+D2T) by directing clients to the appropriate SIP servers. While the regular expression within the NAPTR record is currently empty, the use of this record type highlights a potential area of interest for threat hunters and penetration testers due to its role in facilitating RCS messaging and the possibility of future malicious use.