Yesterday, in a bid to entertain myself for a while, I was playing around with DNS servers. I set up a DNS server locally, which I then set as my primary DNS server. Within it, I added some records that overrode what would otherwise be existing domains: I pointed Google, Facebook, Twitter, etc, at (google.com. 60 IN A, where I had a web server running.

To my surprise, it worked. Visiting http://google.com returned the web page as served by my local web server.

Thing is... google.com is supposed to have preloaded HSTS on it. I was under the impression that my browser should know that google.com is meant to only ever be sent requests via HTTPS, and hence hitting the HTTP version and getting a local page should not work.

Where are my assumptions wrong?

  • Could you revert the DNS, open the Developer Tools, go to the Network Inspection, and open google.com via HTTP? You have to see a 307 Internal Redirect on Chrome. If not, something is wrong. – ThoriumBR Jun 7 '18 at 20:41
  • 1
    You forgot to tell us what browser you were using. – symcbean Jun 8 '18 at 11:33

The domains google.com and www.google.com are not HSTS-preloaded. You can check that here. They don't even initially send a HSTS header.

Other subdomains of Google are preloaded, e.g. accounts.google.com.

Your assumption is correct that for a preloaded domain, accessing the site over plain HTTP in your browser should not be possible, regardless where you point the DNS. You simply checked the wrong domain.

| improve this answer | |
  • The same held for all the domains I listed, though, and Twitter is certainly HSTS-preloaded. – ArtOfCode Jun 7 '18 at 21:06
  • 1
    @ArtOfCode Which browser (and version) are you using? Does it work with any preloaded domain? You may want to consider filing a bug report. – Arminius Jun 7 '18 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.