The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

learn more… | top users | synonyms

4
votes
1answer
807 views

Router DNS getting automatically changed

I don't know if this is the correct forum where to ask, but I didn't find anything more appropriate. I have a TP-Link router model TD-W8951ND, and three months ago I noticed that the network was ...
4
votes
1answer
87 views

I just deployed DNSSec. Is there any benefit in DANE for a CA- issued Cert?

I just deployed DNSSec at https://val-id.com and https://getvalid.com Since DNSSec is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by ...
3
votes
4answers
264 views

Why isn't there a Global Root for SSL?

I was just wondering why there is a file on your computer implementing the trusted root CA's instead of something similar to DNS where there is a file on root servers that computers check against to ...
3
votes
2answers
4k views

DDoS Protection for DNS providers

Zerigo, our DNS provider has reported to have been under heavy DDOS attack in the last 24 hours or so. Considering the distributed nature of DNS, and their architecture consisting of 5 main DNS ...
3
votes
5answers
803 views

Alternatives for DNS resolution

I was told it's a good idea not to use your ISP to resolve DNS, both for privacy issues and because it can be slow. So I wanted to change, but I've read criticism on using OpenDNS (who makes money on ...
3
votes
3answers
170 views

How to determine if resolved ip is rogue or part of CDN?

I'm subscribed to goverment's owned ISP because only this ISP provides access to rural area. It has a bad reputation because it is not only redirects sites, but also injects JavaScript for ...
3
votes
2answers
2k views

Is it less secure to use OpenDNS for banking accounts, SSH, Adsense account?

I have one WiFi connection in my house which I use for my iPad, phone and computers. I want to block adult sites, time consuming sites for every device that use the WiFi connection. So I came across ...
3
votes
1answer
111 views

Is DNSSEC really useless if TLS is properly configured?

I was reading this article http://sockpuppet.org/blog/2015/01/15/against-dnssec/ and this line caught my eye, "With TLS properly configured, DNSSEC adds nothing." My gut reaction was to disagree, but ...
3
votes
1answer
109 views

Google DNS query pointing at ISP instead of Google

I am not sure if this is actually an issue or not or if I am just being too paranoid, but I noticed this upon arriving home to Alaska recently (location is important as you'll see shortly). In short, ...
3
votes
1answer
259 views

Can it be dangerous to use not popular(unknown) dns servers?

There is a service called tunlr, which let's you browse the web with no restrictions(Pandora, Hulu etc.). You just have to use their dns server. But now I'm concerned whether the owners of the dns ...
3
votes
2answers
74 views

A question regarding DNS attacks

When would a DNS attack actually happen? Is it already possible when i connect my pc to the router which is connected to my isp's modem and has received their DNS servers, or later when i am trying ...
3
votes
1answer
1k views

What is a DNS leak?

I'm planning on getting a VPN service (probably Privateinternetaccess) and read that it is imperative to plug DNS leaks. The only information I found on google describing what these are is here and I ...
3
votes
1answer
34 views

What could you do with a PTR record of “localhost”?

In today's log summary from my SSH server, I found the following interesting entry: Illegal users from: 113.175.205.167 (localhost): 2 times Doing a DNS lookup on 113.175.205.167 does indeed ...
3
votes
1answer
283 views

Is this the end of malware use of DNS?

I read about the release of a free dataset of malware related DNS queries called "Predict". A researcher or network security team can download or query this data set and use it to identify malware ...
3
votes
1answer
562 views

How does a client know that a DNS zone is DNSSEC protected?

Recently, I've been reading about DNSSEC and how it works. I found other questions and some very interesting answers on this and other websites related to this matter. However, I have a question to ...
3
votes
1answer
513 views

Why is a separate reconnaissance server needed for DNS cache poisoning?

I'm trying to understand how Metasploit's DNS BailiWicked Host Attack module works. One of the required module options is a "reconnaissance" nameserver (option RECONS). What I understand from the ...
3
votes
2answers
283 views

Unecrypted connection to server - safe?

I am using heroku and cloudflare. I am going to release my website but I don't want do it without SSL. Now I always need an heroku addon to add my SSL certificates which costs $20/month. Cloudflare ...
3
votes
1answer
179 views

How safe is it to use shared SPF record domains?

I'm wondering the following, what if shared SPF records like below are used? v=spf1 include:_spf.google.com ~all v=spf1 include:spf.mandrillapp.com ~all v=spf1 include:servers.mcsv.net ~all Can it ...
3
votes
1answer
216 views

Is a ptr mechanism in an SPF record secure?

If I understand http://www.openspf.org/SPF_Record_Syntax correctly, any machine with an IP that points to my-domain.com can send email as if it's from my-domain.com if I'm using ptr in my SPF record. ...
3
votes
4answers
2k views

Can DNS servers log users requests for commercial use (e.g. track direct access to websites)?

How does it work? For example, could OpenDNS be tracking everything (source ip + requested url) and then selling it to who have the necessary information to correlate the ip addresses with people ...
3
votes
2answers
823 views

How does DNS Changer malware detection work?

This malware directs your computer to use DNS servers under control of the badguys. These DNS servers were taken over by the FBI. They were replaced with clean ones, to prevent service disruption, but ...
3
votes
2answers
53 views

Why does our network firewall drop netbios-ns packets?

In our local domain environment, we use Sophos UTM to protect our network. When I check the firewall logs, I can see that a huge number of packets dropped by the firewall are netbios-ns (UDP 137) ...
3
votes
2answers
76 views

How to protect from WPAD attacks?

If you are in a Windows network, and you basically connect to a website ; And there is an attacker on Linux who changes the hostname to WPAD and configures WPAD.dat in his system, all your PC's ...
3
votes
2answers
111 views

How do I run proper HTTPS on an Internal Network?

This question has been asked several times, I'll link a few: https://superuser.com/questions/791015/https-over-private-network ...
3
votes
1answer
581 views

Is it possible to force client use TCP instead UDP for DNS queries?

Assume I am managing a firewall between DNS server and clients. Is there any way to force clients use TCP rather than UDP, so we can prevent DNS spoof types of DDoS attacks?
3
votes
3answers
226 views

Are IPs and domains in malwaredomainlist.com compromised?

I did an nmap scan on a website that is being hosted by a hosting company. The results showed a rDNS record with an ip and a domain name. When I googled the domain name it appeared in ...
3
votes
2answers
149 views

Which is the best antidote for DNS cache poisoning?

I know some antidotes for DNS cache poisoning attacks, both simple as port randomisation, and more complex as DNSSEC. But, which is the more effective? Which solutions are really deployed in the ...
3
votes
2answers
375 views

I believe my Domain has been hijacked I am not receiving in sales in shopping cart

My IP address is 181.224.153.95 Domain: www.ashaybythebay.com FTP Hostname: m23.siteground.biz I added private domain servers to my domain name ashaybythebay.com and I see the two IP server ...
3
votes
2answers
481 views

DNS cache poisoning

What are the things the attacker needs to know from the victim to perform DNS cache poisoning ? for example : IP , Port number and Transaction number what else ?
3
votes
1answer
515 views

captive portal wikipedia article

Something on the wikipedia page regarding captive portals have confused me: http://en.wikipedia.org/wiki/Captive_portal When a client requests a website, DNS is queried by the browser. The ...
3
votes
1answer
38 views

What security implications does DNS prefetching have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsers already knows where to send the request the instance you click the link. This is ...
3
votes
1answer
91 views

Is DNS leak really an issue?

I'm reading about DNS leak and what threat it can pose to VPN users, for instance, this question. But generally, there's tons of similar topics on the internet. But what are people afraid of? I just ...
3
votes
2answers
52 views

Why gethosbyname() is as bad as gets() by design?

I know gethosbyname() has been obsolete for a long time. But I see static analysers report its use as unsafe, and when softwares remove its usage, it tends to be for security reasons. I know there ...
3
votes
1answer
45 views

How to acquire DNSSEC root trust anchor from IANA?

I want to establish trust in a DNSSEC record. I found, that it can be done $ dig +sigchase +trusted-key=./root.key @8.8.8.8 eesti.ee root.key could be obtained with $ dig . DNSKEY @8.8.8.8 | grep ...
3
votes
2answers
70 views

Is it possible to take over the victim's system only by DNS attacks?

I found this article and it describes some DNS attacks. Those are mainly targeting login credentials, banking information, and so forth. By redirecting the victim to a malicious site it could be also ...
3
votes
1answer
551 views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
3
votes
1answer
124 views

Is there an HSTS equivalent for DNSSec?

Is there any way to set a DNSSec-always policy similar to how HSTS commands Web Browsers to always use HTTPS? This would mitigate a DNSSec-strip attack (similar to SSLStrip) I'm also unclear if this ...
3
votes
1answer
60 views

Wildcard DNS entry from a security PoV

We are going to release our new product which will have customers create their own subdomains. This requires having a wildcard DNS on our main domain (We have no other options, right?) Are there any ...
3
votes
2answers
4k views

Blocking incoming traffic from privileged port (< 1024) to mitigate DNS DDos Amplification attacks

Hope someone can clarify. As I understand, in a DNS DDos Amplification attacks Multiple DNS queries are sent to a vulnerable name server with the source IP spoofed to that of the target server. The ...
3
votes
1answer
43 views

Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?

Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
3
votes
0answers
93 views

Unknown ports shown on Nmap scan…and other strange behavior

My local network has been exhibiting some inexplicable behaviour. Firstly connecting to my websites domain name from inside the lan redirected me to my router's login page. I checked again with 3g ...
3
votes
0answers
58 views

Does DNSSEC still have the “enumerate all names in zone” problem?

According to Wikipedia: DNSSEC introduces the ability for a hostile party to enumerate all the names in a zone by following the NSEC chain. NSEC RRs assert which names do not exist in a zone ...
3
votes
0answers
120 views

Why would home routers accept incoming DNS traffic?

I stumbled upon an interesting paper (PDF Link) where researchers found out that more than 58% of the DNS open resolvers that are blamed in DDoS attacks are in fact home routers distributed by ISPs to ...
3
votes
2answers
143 views

How to confirm that my router is vulnerable to the glibc vulnerability (CVE-2015-7547)?

I have tried PoC from Google (https://github.com/fjserna/CVE-2015-7547) to test my host PC (first execute the server side PoC then execute client side PoC). It was vulnerable. Now I want to check my ...
2
votes
2answers
10k views

what is the Akamai Name Server i see at some big companies

I have played with DNS a lot lately, and i have found that some big companies's web sites uses the Akamai NS as the Name Server for thier WWW servers, for example: $>nslookup > www.redhat.com ...
2
votes
2answers
797 views

Is it a real security benefit if a host uses static IP Addresses for authentication?

As my knowledge about information security is not THAT good and Google did not give me a satisfactory answer I would like to ask the community here: I am working for a company offering online ...
2
votes
2answers
451 views

Might Google log every website I visit using Chrome?

I wanted to start using Chrome for quite some time now, but I really don't want to tell Google about whatever sites I visit. So I was wondering if Chrome sends any data to Google telling them what ...
2
votes
1answer
10k views

How to test for zone transfer? [duplicate]

I heard that it is possible to test for zone transfer attacks on a web application using host and dig commands in Linux. How it is done?
2
votes
1answer
58 views

Is DNS caching a security vulnerability?

In FireFox, for example, there are network.dnsCacheExpiration and network.dnsCacheEntries preferences in about:config. Is increasing the length of time and number of cached DNS entries a security ...
2
votes
1answer
2k views

Is DNS service secure?

I am based outside of the US, but I still want to watch Netflix. So I am thinking about signing up a DNS service such as unblocked-us, but I worry that as I am now querying an unknown ( relative to ...