1

Will the DNS server reply to the spoofed address if you send a DNS request on behalf of it?

What I'm trying to ask isn't DNS spoofing but spoofing the source address.

Improve this question
5
  • 3
    Yes, that's how amplification attacks work and why we should be pressuring ISPs to implement BCP38. (This doesn't answer your question exactly but hopefully the quick pointer helps to google/duckduckgo for the information you're looking for!)
    – Luc
    Commented Mar 23, 2020 at 12:48
  • All servers will respond to spoofed addresses unless it has another protocol to verify the source.
    – schroeder ♦
    Commented Mar 23, 2020 at 12:57
  • Yeah sorry I'm writing a scapy script to spoof DNS queries and the server isn't replying. Thought there was some weird mechanism preventing it. Guess it's just my bad programming haha.
    – AdrianL
    Commented Mar 23, 2020 at 12:57
  • 1
    "it isn't replying" -- to whom? Your script or to the IP you spoofed? Have you run packet captures to see what's actually happening on the wire? Does the DNS server have a route to the spoofed IP?
    – schroeder ♦
    Commented Mar 23, 2020 at 13:11
  • It isn't replying to the IP I spoofed. I have run packet captures with wireshark. The DNS server has a route to the spoofed IP.
    – AdrianL
    Commented Mar 24, 2020 at 0:39

1 Answer 1

Reset to default
1

It depends on what underlying protocol is in use.

As a general rule of thumb, network protocols that establish connections or use handshakes are immune to source address spoofing. This is because if the source address is spoofed then a connection will never be successfully made (since the spoofed destination won't know how to respond), no connection will be established, and nothing more than an initial handshake packet will be sent. For some examples:

  1. IP does not use handshakes and is vulnerable to source spoofing
  2. TCP (aka TCP/IP, which is built on top of IP) does use handshakes and is immune to source address spoofing
  3. UDP is a connection-less protocol and is vulnerable to source address spoofing.

"Standard" DNS can use TCP/IP (h/t Patrick) or UDP. Typically it defaults to UDP, which is connection-less and therefore vulnerable to source-address spoofing. This means that if you send a spoofed UDP packet to a DNS server with a forged address, the DNS server should send the response to the spoofed source address, not you.

However, there are newer DNS "versions" rolling out that use different underlying protocols. For instance DoH (DNS over HTTPS) uses HTTPS itself, which is built on top of TCP/IP. Therefore you would not be able to spoof a source address to a DNS server using DoH, for the same reason why you can't spoof a source address for an HTTP server. Similarly, whether or not the other new variants of DNS are vulnerable to such attacks depends on the underlying protocol used.

Improve this answer
2
  • Standard DNS does use TCP as well. I mean it is not less standard than on UDP. It is true that at least for performance reasons, nameservers try to use UDP as much as possible. Also, alongside DoH you have DoT which is DNS over TLS (and hence over TCP/IP), and soon around the curve you will have DoQ or DNS over Quic.
    – Patrick Mevzek
    Commented Mar 24, 2020 at 0:28
  • @PatrickMevzek Thanks, I updated my answer. I actually didn't even know that DNS could use TCP/IP. I've only ever heard of it using UDP. There's something new to learn every day...
    – Conor Mancone
    Commented Mar 24, 2020 at 18:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .