Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

Filter by
Sorted by
Tagged with
4
votes
3answers
296 views

Why are DNS requests visible with DNS over HTTPS enabled?

So, Firefox 73 rolled out today and with it comes a new DNS option called NextDNS. I thought of giving it a shot and clicked "Enable DNS over HTTPS" and selected NextDNS. Now, my understanding of ...
0
votes
1answer
54 views

DNS communicating with a remote host on an unusual server port 53

We have an Active Directory EC2 server on AWS US East region that has DNS enabled to resolve only internal hostnames. It is not reachable from any hosts on the public internet. Recently we enabled an ...
0
votes
0answers
117 views

Why is DNS apparently involved in typing “dir” on Windows 10? [migrated]

For complicated reasons, I have been forced to make an identical copy of cmd.exe and rename it to cmd-2.exe, which I put a shortcut to in the Taskbar. The reason is purely to have them "grouped" in ...
1
vote
1answer
55 views

Basic Auth exposed to ISP/DNS?

Would someone using basic authentication in a URL such as https://username:password@example.com have their credentials be visible to their ISP or DNS?
0
votes
1answer
71 views

Should a DNS server restrict reverse lookups from external hosts?

What risks are there in allowing external clients to resolve internal IPs to their domain names? The server is used internally for clients, as well as for external clients needing to resolve a web ...
0
votes
1answer
85 views

Verify Quad9 is working

Disclaimer: I am a complete neophyte. I set 9.9.9.9, Quad9, as my DNS in my router's configuration. How do I verify Quad9 is working and that I am benefiting from its features, especially encrypted ...
1
vote
1answer
66 views

How does proxychains avoid DNS leaks?

Also directly related, how are the DNS servers queried when using proxychains? Assume I'm using Tor for proxychains. If I uncomment the DNS part of proxychains.conf, my requests supposedly get sent ...
1
vote
1answer
51 views

Can I test ssl connection locally with a valid certificate (CA) with local dns?

I have a wildcard valid certificate signed by Certificate Authority. Is it possible to test the https locally from the server without a registered DNS? My idea is to bind the domain name with 127.0....
0
votes
1answer
55 views

Does Kerberos authentication handle DNS names the same way between Windows 7 and Windows 10?

Recently, we migrated from Windows 7 to Windows 10 and during that migration, we progressively ran into some issues with our NAS device. To be more precise, we progressively noticed some tcp socket ...
1
vote
1answer
69 views

Why did browsers choose to implement HSTS with Preload over checking custom DNS information?

Browsers and standards bodies favor HSTS with Preload because it avoids ever sending an http request to a website that supports https. This is good, because cleartext http requests can be intercepted ...
0
votes
1answer
200 views

DNS Tunnel or Not (g01.msn.com)

Thought I found DNS tunneling and but after a closer look it seems a bit more complex. Anyone seen this traffic before? User starts their computer, launches firefox.exe, then they hit c.msn.com ...
1
vote
1answer
58 views

No MX Records on a Possible Phishing domain?

I saw on my SMTP logs that it queried a possible phishing domain, I look up on its MX records and it didn't have one. Does the domain need an MX record before sending phishing emails?
0
votes
0answers
27 views

Are there any risks selling subdomains? [duplicate]

I am considering buying a nice domain name (say example.com) and would be interested in reselling subdomains (e.g. chris.example.com) to third parties (or close friends). I would give them full ...
0
votes
1answer
58 views

Is there something like DynDNS for a DNS service?

I run a small DNS server (pihole) at home behind a firewall, with some custom filtering. It mainly filters ads and trackers, plus some top level domains I want to avoid navigating to. I have an IPv4 ...
3
votes
2answers
93 views

Weird DNS queries to messager.xicp.net

A DNS query for this domain (messager.xicp.net) was classified and detected as "Trojan.Generic.DNS" by the FireEye NX in our network. So, I used both VirusTotal and abuseibdb sites to check this ...
0
votes
1answer
89 views

How to protect users from malware utilizing protocols such as DNS over HTTPS?

With the increased drive to enable DNS over HTTPS (DoH), it's likely that non-browser applications and systems may utilize DoH services other than those promoted by Mozilla and Google. Since malware ...
2
votes
1answer
55 views

Certificate warning when I enable DNSSEC

I registered mydomain.net (with Google domain registration server). In the DNS settings on the google control panel, I say that mail.mydomain.net should go to the email cloud app (business.zoho.com in ...
1
vote
1answer
152 views

Another domain pointed to my server, what are the risks?

I recently had another domain point to one of my servers. After adding some nginx configuration I was able to mitigate this. My server now throws a 404 in this scenario. My question is what are the ...
2
votes
1answer
112 views

Can an ISP redirecting DNS traffic be detected by the end user?

If an ISP wants to gather profiles on users, or block certain websites, they can fairly easily redirect outgoing UDP traffic to port 53 to their own DNS servers. How could this be detected by the end ...
0
votes
0answers
38 views

Can DNS-over-HTTPS be broken by reverse DNS lookups? [duplicate]

If anyone can see the receiver IP address in a HTTPS request, what will stop ISPs from analysing the packet, reverse DNS lookup the IP and block the access to the domain the client is trying to reach. ...
0
votes
1answer
100 views

Why would my firewall show that my computer connects to DNS servers other than the ones I have defined?

I'm looking at my firewall logs and even though I have my computer set to a static DNS, the logs are showing that my computer is reaching out to multiple DNS servers via port 53. I am worried about ...
0
votes
0answers
29 views

How does Smart DNS intercept traffic and what are the implications?

In reading about Smart DNS, my understanding is that a device such as a router is configured with the DNS server IP addresses of the Smart DNS provider as opposed to one that is issued by the ISP or ...
0
votes
1answer
65 views

Universal DNS Resolver [closed]

I would like to implement a DNS client which should be able to resolve any valid domain public, private or otherwise (tor,i2p). What's the best way to achieve this? I know that I need to pick a ...
0
votes
0answers
44 views

Trace the orgins of a DNS request [duplicate]

I installed a DNS server on a Raspberry PI to monitor DNS requests. One request that is curious is "fscta65w.com." It keeps showing up in the querlog from a macbookPro but I can't seem to find out the ...
0
votes
0answers
46 views

DNS Spoof Printer on network

I was wondering if it would be possible to arp spoof my printer and router arpspoof -t printer router arpspoof -t router printer and then reroute all print requests to my CUPS print server on ...
0
votes
0answers
33 views

Is there an alternative to HPKP for dyndns?

For dyndns it's fairly easy to replace the machine behind a domain name: either if the subscription runs out or if the IP changes and the dyndns service hasn't been updated. In that case one can ...
1
vote
1answer
70 views

Does a searchable public database exist of (hostname; ip) mappings?

This question is not about the trivial usage of the forward/reverse DNS. Getting the IP of a hostname is trivial (DNS), and using reverse DNS, also we can get (typically) a single hostname of an IP. ...
0
votes
1answer
235 views

nmap: Same IP, different domain names, different results?

I'm scanning a network (whose name will not be stated). It has >1 IP addresses. When I tried scanning its subdomains, there are several subdomains that are translated to the same IP address but return ...
0
votes
0answers
33 views

Auditing Sysmon 10 DNS events on Windows 2008 R2

I have installed Sysmon 10 on a Windows 2008 R2 box in the hope of, amongst other things, capturing DNS requests. Sysmon appears to be capturing all other Event ID's except for 22. I have installed ...
2
votes
1answer
107 views

Does a CAA record on a local hostname in a LAN offer additional security?

A CAA DNS record limits the certificate authorities that may issue a certificate for a domain and its subdomains. Do CAA records make sense in a LAN environment? Assume internal hostnames such as ldap....
0
votes
1answer
134 views

How does DoH protect against ISP tracking?

Seems like a modern ISP would already be equipped with some basic level of packet inspection to identify outgoing TCP connections even if just for doing traffic shaping or carrier-grade NAT, and ...
0
votes
0answers
28 views

How do I white list domain in ASG's?

I need to whitelist https://hooks.slack.com in Application Security Group (ASGs). As I have understood ASGs are static and they don't resolve DNS. Then how do I whitelist https://hooks.slack.com ...
12
votes
3answers
4k views

Is a global DNS record a security risk for phpMyAdmin?

Services like phpMyadmin needs a domain name to access. Instead of adding a global DNS record, one could make a local DNS record (e.g. in /etc/hosts) to access the site. Would it increase security if ...
2
votes
1answer
57 views

Jump box DNS in the public

We have a jump box that allows people to connect via SSH into the system. Would it be a security concern by adding a public DNS entry that points to the jump box? (Would this not be security through ...
23
votes
4answers
5k views

More than three domains hosted on the same IP address

Not on purpose I did a reverse IP address look up on my site, and it shows that there are three other websites hosted on my server, and now I'm worried. My web is arturofm.com, and here is the lookup:...
2
votes
0answers
87 views

How can an attacker hijack js/css content?

I just encounter an issue, the cached js files showed porn site Here's the simple network diagram. https://cdn.mysite.com/js/app.js shows a porn site, but if I add in query string https://cdn....
0
votes
1answer
84 views

Should current DNS servers respond to obsolete DNS records? [closed]

Here is a list of obsolete DNS record types. Should I restrict my DNS server to not respond to these query types? Why are current public DNS servers responding to these query types?
0
votes
0answers
56 views

Why am I seeing SSL events resolve to OpenDNS IPs?

This organization I'm working for uses OpenDNS/Cisco Umbrella. I'm confused as to why I'm seeing requests for SSL traffic resolved to 146.112.255.155 146.112.250.83 146.112.250.64 146.112.250.87 146....
0
votes
1answer
160 views

Securing DNS by blocking querys AND responses [Dnscrypt questions]

Visiting facebook.com you will query s.update.fbsbx.com. s.update.fbsbx.com is a CNAME to s.agentanalytics.com. Currently, the only way to block s.agentanalytics.com is to block s.update.fbsbx.com via ...
2
votes
2answers
268 views

Does changing DNS help prevent MITM on ISP level?

A few days ago Kazakhstan gov-t passed a law to enforce using gov-t signed SSL certificates on all https traffic on all (almost) ISPs. So when you visit https://google.com your browser will warn that ...
1
vote
0answers
285 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
0
votes
0answers
54 views

Why is the attacker allowed to create DNS traffic in a DNS cache poison attack?

According to this article, a DNS cache poisoning attack is performed the following way: Send a large number of resolution requests each spoofed with different source IP information for www....
1
vote
1answer
71 views

Checking the reverse IP address to find all DNS records

In the context of Vulnerability Assessment, what is the purpose of checking the reverse IP address of an end-point to find all DNS records of ‘A’ type associated with the IP? I've come across this ...
0
votes
0answers
153 views

How to respond domain fluxing happening on workstations

A few workstations have been making dns requests to what looks to be DGA domains and talked to the security appliance vendor with little help. A vendor technician told me that some Apple servers ...
1
vote
1answer
652 views

Level 3 DNS default response for invalid host names

I was recently flummoxed by an issue related to me setting my router's static DNS servers to what I understand to be Level 3 DNS servers, (4.2.2.1, 4.2.2.2, etc.). For work I use a company VPN. On ...
0
votes
1answer
693 views

Soft-fail vs Hard-fail SPF + Monitor vs Reject+Strict DMARC, could it be counterproductive?

I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC. What caught my eye were two things they recommended in the domain setup: ...
2
votes
1answer
133 views

A third party Web site wants me to validate my domain ownership using a TXT record

What are the security risks with adding TXT records for third party tools? Can they get any information back from your servers with adding that record for them? The example below is from the "have i ...
2
votes
3answers
105 views

What happen when a local device have the same IP as an external website

When I enter 'google.com' in my web browser, my computer goes to the DNS server and gets Google's server IP address, then it look for that address in the local network and when it doesn't find it it ...
0
votes
1answer
482 views

What is Passive DNS Replication?

I use Virus Total for Malware Research, and I saw that it has a field called: "Passive DNS Replication", but I do not exactly understand what that means.I searched in VT blog, and they said that it is ...
-1
votes
1answer
110 views

setting up ssl for cname only subdomain [closed]

I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have. I've a domain, say abc.com, which is live with ssl on ...

1 2 3 4 5 13