1

Let's assume my domain example.com has ns1 record pointed to a random IP address 192.0.2.111.

When somebody tries to resolve example.com, can the dns server at 192.0.2.111 see what IP is trying to resolve that domain name?

2

Not exactly. Keep in mind you won't see requests from systems which either have the dns info cached or are using a dns server which has it cached. Likewise if you have someone visiting or attacking your site who is using an external dns server the dns query will likely come from the IP address of the dns server they are using and not the visitor/attackers IP itself. So you will see the query itself but it may come from a public DNS server.

| improve this answer | |
0

Like Trey says, the IP of the stub resolver (the one starting the DNS query) is not visible. The IP address visible would be the IP address of the DNS recursive server.

Having said that, if you want to make the client IP visible, you can install the DNS resolver (BIND, djbdns) on the client itself.

| improve this answer | |
  • That or just add a /etc/hosts entry and prioritize that over DNS if it's not already prioritized by default. – Trey Blalock Jul 29 '16 at 15:33
  • You mean add a static mapping for 192.0.2.111? What if the nameserver for example.com keeps changing. {/etc/hosts} will be hard to maintain. – sandyp Jul 29 '16 at 17:21
  • sorry not enough context. i was replying in the sense of if you want to make the IP visible. For example if you just wanted to do this to test something. Definitely not a long term solution. – Trey Blalock Jul 29 '16 at 17:29
-2

Yes, each DNS request packet has it's origin included. That's how the response is capable of getting the record back to the requester. To learn more about what's in a DNS request packet and how they work take a look here:

http://www.firewall.cx/networking-topics/protocols/domain-name-system-dns/160-protocols-dns-query.html

| improve this answer | |
  • I think there may have been a misunderstanding. Note that the DNS server at 62.12.18.180 is not necessarily the one fulfilling the request. – Jordan Melo Jul 26 '16 at 19:39
  • Problem is, you will never be certain if the origin is a client or another DNS server. Probably it's a DNS server asking in name of its client. – ThoriumBR Jul 27 '16 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.