Will the DNS server reply to the spoofed address if you send a DNS request on behalf of it?

What I'm trying to ask isn't DNS spoofing but spoofing the source address.

  • 3
    Yes, that's how amplification attacks work and why we should be pressuring ISPs to implement BCP38. (This doesn't answer your question exactly but hopefully the quick pointer helps to google/duckduckgo for the information you're looking for!) – Luc Mar 23 '20 at 12:48
  • All servers will respond to spoofed addresses unless it has another protocol to verify the source. – schroeder Mar 23 '20 at 12:57
  • Yeah sorry I'm writing a scapy script to spoof DNS queries and the server isn't replying. Thought there was some weird mechanism preventing it. Guess it's just my bad programming haha. – AdrianL Mar 23 '20 at 12:57
  • 1
    "it isn't replying" -- to whom? Your script or to the IP you spoofed? Have you run packet captures to see what's actually happening on the wire? Does the DNS server have a route to the spoofed IP? – schroeder Mar 23 '20 at 13:11
  • It isn't replying to the IP I spoofed. I have run packet captures with wireshark. The DNS server has a route to the spoofed IP. – AdrianL Mar 24 '20 at 0:39

It depends on what underlying protocol is in use.

As a general rule of thumb, network protocols that establish connections or use handshakes are immune to source address spoofing. This is because if the source address is spoofed then a connection will never be successfully made (since the spoofed destination won't know how to respond), no connection will be established, and nothing more than an initial handshake packet will be sent. For some examples:

  1. IP does not use handshakes and is vulnerable to source spoofing
  2. TCP (aka TCP/IP, which is built on top of IP) does use handshakes and is immune to source address spoofing
  3. UDP is a connection-less protocol and is vulnerable to source address spoofing.

"Standard" DNS can use TCP/IP (h/t Patrick) or UDP. Typically it defaults to UDP, which is connection-less and therefore vulnerable to source-address spoofing. This means that if you send a spoofed UDP packet to a DNS server with a forged address, the DNS server should send the response to the spoofed source address, not you.

However, there are newer DNS "versions" rolling out that use different underlying protocols. For instance DoH (DNS over HTTPS) uses HTTPS itself, which is built on top of TCP/IP. Therefore you would not be able to spoof a source address to a DNS server using DoH, for the same reason why you can't spoof a source address for an HTTP server. Similarly, whether or not the other new variants of DNS are vulnerable to such attacks depends on the underlying protocol used.

  • Standard DNS does use TCP as well. I mean it is not less standard than on UDP. It is true that at least for performance reasons, nameservers try to use UDP as much as possible. Also, alongside DoH you have DoT which is DNS over TLS (and hence over TCP/IP), and soon around the curve you will have DoQ or DNS over Quic. – Patrick Mevzek Mar 24 '20 at 0:28
  • @PatrickMevzek Thanks, I updated my answer. I actually didn't even know that DNS could use TCP/IP. I've only ever heard of it using UDP. There's something new to learn every day... – Conor Mancone Mar 24 '20 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.