Let's assume my domain
ns1 record pointed to a random IP address
When somebody tries to resolve
example.com, can the dns server at
192.0.2.111 see what IP is trying to resolve that domain name?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Not exactly. Keep in mind you won't see requests from systems which either have the dns info cached or are using a dns server which has it cached. Likewise if you have someone visiting or attacking your site who is using an external dns server the dns query will likely come from the IP address of the dns server they are using and not the visitor/attackers IP itself. So you will see the query itself but it may come from a public DNS server.
Like Trey says, the IP of the stub resolver (the one starting the DNS query) is not visible. The IP address visible would be the IP address of the DNS recursive server.
Having said that, if you want to make the client IP visible, you can install the DNS resolver (
BIND, djbdns) on the client itself.
Yes, each DNS request packet has it's origin included. That's how the response is capable of getting the record back to the requester. To learn more about what's in a DNS request packet and how they work take a look here: