0

Visiting facebook.com you will query s.update.fbsbx.com. s.update.fbsbx.com is a CNAME to s.agentanalytics.com. Currently, the only way to block s.agentanalytics.com is to block s.update.fbsbx.com via hosts. Windows DNS client, and even wildcard blocking resolvers such as Dnscrypt do not have the ability to block the parent domains of CNAME replies.

13:19:30 dnsmasq[1211]: query[A] s.update.fbsbx.com from 192.168.50.142
13:19:30 dnsmasq[1211]: forwarded s.update.fbsbx.com to 127.0.0.1
13:19:30 dnsmasq[1211]: reply s.update.fbsbx.com is <CNAME>
13:19:30 dnsmasq[1211]: reply s.agentanalytics.com is
13:19:30 dnsmasq[1211]: reply agentanalytics.com is 52.20.233.11
13:19:30 dnsmasq[1211]: reply agentanalytics.com is 35.170.177.215
13:19:30 dnsmasq[1211]: reply agentanalytics.com is 34.235.44.232
13:19:30 dnsmasq[1211]: reply agentanalytics.com is 34.194.252.192
13:19:30 dnsmasq[1211]: reply agentanalytics.com is 18.206.130.128
13:19:30 dnsmasq[1211]: reply agentanalytics.com is 52.202.107.183
13:19:30 dnsmasq[1211]: reply agentanalytics.com is 18.209.97.44
13:19:30 dnsmasq[1211]: reply agentanalytics.com is 35.173.82.169
13:19:30 dnsmasq[1211]: reply agentanalytics.com is 23.22.178.204
13:19:30 dnsmasq[1211]: reply agentanalytics.com is 18.206.103.1

Sometimes there are multiple CNAMES that reveal their actual hidden associations in replies, example:

13:55:28 dnsmasq[26607]: query[A] su.itunes.apple.com from 192.168.50.96
13:55:28 dnsmasq[26607]: forwarded su.itunes.apple.com to 127.0.0.1

13:55:29 dnsmasq[26607]: reply su.itunes.apple.com is <CNAME>
13:55:29 dnsmasq[26607]: reply su-cdn.itunes-apple.com.akadns.net is <CNAME>
13:55:29 dnsmasq[26607]: reply su-applak.itunes-apple.com.akadns.net is <CNAME>
13:55:29 dnsmasq[26607]: reply su.itunes.apple.com.edgekey.net is <CNAME>
13:55:29 dnsmasq[26607]: reply e673.dsce9.akamaiedge.net is 184.50.162.217

13:55:29 dnsmasq[26607]: query[A] xp.apple.com from 192.168.50.96
13:55:29 dnsmasq[26607]: forwarded xp.apple.com to 127.0.0.1
13:55:29 dnsmasq[26607]: reply xp.apple.com is <CNAME>
13:55:29 dnsmasq[26607]: reply xp.itunes-apple.com.akadns.net is <CNAME>
13:55:29 dnsmasq[26607]: reply xp.apple.com.edgekey.net is <CNAME>
13:55:29 dnsmasq[26607]: reply e17437.dscb.akamaiedge.net is 23.214.192.96

DNSCRYPT allows wildcard blocking of outgoing domain queries for example [analytics] but it will not automatically block incoming responses nor the caching of s.agentanalytics.com ips. Or for example, if one blocks s.agentanalytics.com in windows hosts, or dnscrypt, it will still be accessible via s.update.fbsbx.com.

I showed dnscrypt's coder how this analytics domain bypasses his wildcard protections, and he told me "These entries are not within the parent zone and are ignored by all stub resolvers." And here he goes into more detail

He also stated "I think you got confused by what dnsmasq is logging, which, granted, is very confusing. There is only one question here A s.update.fbsbx.com, and one matching response CNAME s.update.fbsbx.com. The rest is garbage ignored by resolvers, as it is not within the parent zone."

However if you robtex and dnsmasq demonstrates that it includes an analytics domain s.agentanalytics.com https://www.robtex.com/dns-lookup/s.update.fbsbx.com

If these IP's are ignored by the stub resolver [that includes windows DNS client] as he previously suggested, they would not be cached to begin with. I am also curious if it is possible some of these these IP's are potentially usable by a state party/MITM as suggested here While browsing on Facebook, I saw s.update.fbsbx.com in Umatrix, what IP then would this domain be associated with except s.agentanalytics.com ip addresses... well it would be s.agentanalytics.com of course.

Simply, s.update.fbsbx.com is used by dnscrypt and dnsmasq etc instead of s.agentanalytics.com however it is pointing to IP's associated with s.agentanalytics.com.

If DNSCRYPT wildcard blocks refused caching these CNAME ip responses and blocked their parent domain, one could better secure their networks.

The question is clearly, am I incorrect in my assertions, is there anything I am missing?

Here is another example, of 21 queries occur when an Iphone immediately connects to WIFI, responses include 72 domains & IP's that are not in the parent domain. He is saying this is all ignored.

Here, https://pastebin.com/GYSEw1dY

0

I was correct. I was given the answer by the developer of the DNSCRYPT himself, and that is the following:

Name blacklists are applied to incoming queries. If there is a match, nothing will be forwarded to upstream resolvers. They will not know that a client asked for one of these names.

The flipside that responses are not inspected for CNAME records possibly matching blacklists.

This will probably not be implemented, but what you can do is block IP addresses instead, as these rules are applied to responses.

SRC: https://github.com/jedisct1/dnscrypt-proxy/issues/900#issuecomment-516693295

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.