Yesterday, in a bid to entertain myself for a while, I was playing around with DNS servers. I set up a DNS server locally, which I then set as my primary DNS server. Within it, I added some records that overrode what would otherwise be existing domains: I pointed Google, Facebook, Twitter, etc, at 127.0.0.1 (
google.com. 60 IN A 127.0.0.1), where I had a web server running.
To my surprise, it worked. Visiting
http://google.com returned the web page as served by my local web server.
google.com is supposed to have preloaded HSTS on it. I was under the impression that my browser should know that
google.com is meant to only ever be sent requests via HTTPS, and hence hitting the HTTP version and getting a local page should not work.
Where are my assumptions wrong?