I had some difficulty in grasping the concept on how "DNS sinkhole" is being utilize.

Is it like setting up something similar to a honeypot to lure attackers away from the actual network, so that we as "cyber analyst" will be able to understand and learn about the tactics, techniques and procedure (TTP) being used by the attacker?

For example, I am afraid my data might be exfiltrated by an attacker, and I plan to setup a DNS sinkhole, does DNS sinkhole actually cause an alarm or alert the attacker that DNS sinkhole is being setup?


A DNS sinkhole like pihole (https://pi-hole.net/) just filters DNS requests from your internal network clients and silently blocks those requests that are for undesirable sites; it is NOT a honeypot. It is essentially invisible: just returning "domain not found" for blocked names. Many people use them as ad blockers, or to prevent access to various kinds of "undesirable" destinations.

A do-it-yourself setup like pihole can also improve DNS performance by serving as a local cache, only passing request up to a public DNS server when necessary. DNS filtering is also available as a service from places like OpenDNS (https://www.opendns.com/setupguide/#familyshield), or is an option in many home internet routers.

  • thank you for replying. By setting up a DNS sinkhole, are the attackers aware of it in terms of causing an alarm or alert? – 1g0tquestions Mar 5 at 4:55
  • The sinkhole is in your internal network, only used by clients there. It is not exposed to the Internet at all. An attacker who has already compromised your network could simply bypass any DNS filtering by using destination IP addresses directly, which would be much harder to trace. Understand that a sinkhole isn't usually designed to raise alarms. It isn't a honeypot, and isn't intended to "catch" anyone. It's purpose is more likely to protect you from yourself - blocking known phishing sites, virus sites, popup ads, adult/porn sites, and that sort of thing. – pmdba Mar 5 at 5:03
  • As a DNS server, my home pihole handles almost 100K requests per day for about 20 devices. About 15-20% of those get blocked - mostly for online ads. Can you imagine getting 20K e-mails per day as alerts? – pmdba Mar 5 at 5:08
  • I saw on cyware.com/news/… that sinkhole can also be configured to be external. – 1g0tquestions Mar 5 at 5:41
  • That is a totally different thing. A sinkhole network (aka honeynet) is a honeypot, but now you're talking about setting up an entire network just to study malicious user behavior. The point of the article is that this requires the assistance of real DNS owners - to set up domains that look tempting and monitor the requests for them in real DNS servers for patterns. This is not about defending a network people actually use, or setting up a DNS sinkhole. – pmdba Mar 5 at 12:35

A DNS sinkhole's purpose is to falsify the DNS response. The goal is not to allow the endpoint to connect with the intended target. The sinkhole mechanism (a recursive DNS server) will prevent the endpoint from resolving the real IP of the target hostname. Instead of an end-user browsing to a malicious domain, the request to example.com would provide an IP address of the sinkhole target, not the true IP of example.com. If the needs are for business, this and other features (policies, block page, DNS logs) are provided by a protective DNS service. This type of service supports various network, remote, and browser deployment scenarios. This is also known as a DNS firewall too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.