Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

Filter by
Sorted by
Tagged with
1 vote
2 answers
9k views

Does it make sense to use CloudFlare's DNS in addition to NordVPN?

Starting at the Computer level, NordVPN gets installed. But according to the experts who know a lot better, a VPN isn't good enough. So going to the router's IPv4 network settings, the default DNS is ...
2 votes
2 answers
138 views

Avoid leaking IP address of my home DNS server

I'm using AdguardHome as a DNS server to filter a lot of stuff. As an upstream DNS, I use a bind server which acts as a local root server (as described at https://localroot.isi.edu). This server is in ...
165 votes
10 answers
219k views

How do I run proper HTTPS on an Internal Network?

This question has been asked several times, I'll link a few: https://superuser.com/questions/791015/https-over-private-network https://stackoverflow.com/questions/616055/https-certificate-for-...
1 vote
1 answer
481 views

How to detect malicious actor altering DNS responses?

I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist. If I do following on my Windows machine: ipconfig /flushdns ...
1 vote
1 answer
218 views

How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?

This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
1 vote
1 answer
1k views

Is Anonymized DNSCrypt over Tor a better alternative to having Doh+ECH?

I use dnscrypt-proxy's anonymized DNScrypt with multiple relays, force it all to use TCP, route them over Tor. Does this prevent my ISP or anyone in my country to see my DNS queries and client hellos ...
1 vote
1 answer
1k views

How to check to see whether DNS over TLS is blocked in my network by ISP?

I'm looking for a method to check whether DNS over TLS is blocked in my network by my ISP or not. A method that isn't just trial and error of a bunch of popular DoT providers to see which one connects ...
1 vote
1 answer
125 views

Is it reasonable to have a product that requires LLMNR or mDNS?

I am trying to figure out the best way to manage security certificates for embedded devices who's webpage is accessed via IP address, and then the scenario for when that IP address changes. Currently, ...
3 votes
1 answer
470 views

Does subdomain DNS cache poisoning depend on the authoritative name server ignoring requests for non-existing domains?

I'm reading "Introduction to Computer Security", Pearson New International Edition, 1st edition, by Goodrich and Tamassia. On the subject of DNS cache poisoning, they mention that a "...
0 votes
1 answer
355 views

Why am I seeing SSL events resolve to OpenDNS IPs?

This organization I'm working for uses OpenDNS/Cisco Umbrella. I'm confused as to why I'm seeing requests for SSL traffic resolved to 146.112.255.155 146.112.250.83 146.112.250.64 146.112.250.87 146....
1 vote
1 answer
958 views

DNS Hijack: Only spoofing sites listed in etter.dns

I'm trying to create a more practical DNS Hijack MITM attack. I do the traditional ARP poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly ...
2 votes
0 answers
95 views

Does DNSSEC prevent man-in-the-middle at all? [duplicate]

I just watched a video on DNS that explained that if there is a man-in-the-middle or if someone has taken over your resolver, DNSSEC can prevent the responses from being tampered with because the ...
0 votes
1 answer
115 views

How can I test in my device checks DNS CAA correctly and rejects TLS certificates that are signed by an unauthorized CA?

I would like to know how I can test if my devices, or browsers1 checks and applies DNS Certification Authority Authorization (CAA) correctly. And if it does not, how I can enable it and enforce CAA to ...
0 votes
0 answers
88 views

Understanding DNSSEC NSEC3 output for valid domain name

I am trying to understand NSEC3 record when querying for existing domain name, for NXDOMAIN I understand how it works. RFC has example about WildCard, NODATA & NXDOMAIN So I fired these queries ...
5 votes
2 answers
2k views

Can someone explain me the DNSSEC NSEC3 output?

I'm trying to understand how NSEC and NSEC3 records work in DNSSEC. When I query for an non-existent domain with supports NSEC3, I get the following output $ dig +dnssec NSEC3 gggg.icann.org. | grep -...
1 vote
2 answers
4k views

Using Android private DNS with VPN

Android allows now to set "private DNS" in the settings (which also allows using DNS over TLS - sadly over HTTPS atm only works for specific DNS providers). What I am trying to establish is: ...
0 votes
0 answers
27 views

When using a VPN is the device DNS cache still written to? [duplicate]

When I am using ProtonVPN, does the VPN server run DNS resolution upon receiving the request, similar to a Tor exit node, thereby bypassing the device's DNS cache? Or do my browser's DNS queries still ...
0 votes
2 answers
136 views

Why spamassasin is doing dns lookup?

I have a server which have configured Amavis and Spamassasin (in default state only). I recently noticed log lines that probably indicate DNS query failure, below is an excerpt: Nov 21 11:15:40 ...
7 votes
2 answers
2k views

What happens if a DNS record points to non-controlled IP address?

If a domain, for example foo.com is pointed to a IP address (A record) outside of my control, for example the Twitter IP address. And the domain is visited using a browser: What will be displayed in ...
3 votes
1 answer
392 views

Is Android private DNS using domain name a security risk?

Android has the option for using private DNS, but it requires a hostname, not an IP of the DNS server. Isn't entering the domain name of a DNS server a chance for MITM attacks and DNS poisoning? How ...
0 votes
2 answers
203 views

Why does turning on encrypted DNS unblock some geo locked websites?

When I turn on Warp provided by Cloudflare or use 1.1.1.1, it unlocks some of the websites which are geo locked. How does it unblock the websites which are blocked by ISP?
77 votes
7 answers
16k views

What makes Let's Encrypt secure?

Let's Encrypt is an initiative from the Electronic Frontier Foundation (EFF), Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to automatically provide every ...
0 votes
1 answer
120 views

How can an email forwarding service send email with a "From" from a domain they don't control, and still pass SPF?

Let's say: [email protected] sends an email to [email protected]. Bob owns the domain bob.com but doesn't manage an emailing server. Instead he uses an email forwarding service (provided by his registrar /...
0 votes
1 answer
2k views

Are my DNS requests encrypted when I use VPN and DNS of Google or others?

When I use my ISP's DNS servers and I am connected via OpenVPN the DNS trafic will not bounce through the VPN tunnel. When I use others' DNS servers will my DNS traffic bounce through the VPN ...
1 vote
1 answer
2k views

How bad it would be? If hackers managed to take down all 13 Root DNS servers at the same time? [closed]

Would such huge DDoS attack can cause any economical damage? How severe this DDoS attack would be, if all 13 Root DNS servers got successfully DDoSed/flooded and taken out? Would any websites even ...
0 votes
0 answers
125 views

What is the easiest and most effective way to filter IP-only accesses?

On MacOS and Windows 11, I’ve repeatedly seen direct IP accesses to *.deploy.static.akamaitechnologies.com domains (discovered via PTR DNS lookups). DNS filters like NextDNS presumably don’t see this ...
1 vote
1 answer
284 views

Can DNS providers know my IP address?

I know how domain name system (DNS) works a bit. But don't know if providers of public DNS like Google or Cloudflare can know my IP address.
1 vote
1 answer
226 views

Can my ISP see request data being posted to a website when a DNS leak occurs

From what I understand, the ISP can see the host you're trying to connect to in the event of a DNS leak. But does that mean they can see the data being sent like the requests body? or even headers? Or ...
0 votes
1 answer
239 views

can a VPN provider do DNS poisoning?

I was wondering if we push our DNS over the VPN and basically let them do DNS resolution, is it possible to perform DNS poisoning and man in the middle attack on us? I know browsers check certificates ...
1 vote
2 answers
2k views

How does Domain Fronting work in practice

While reading about Domain Fronting (and Google and Amazon's decision to ban it), I came across this blog where the author has identified domains that allow fronting. From the blog, doing something ...
34 votes
4 answers
9k views

Domain about to expire. Afraid that new owners will spread malware

I have a domain that is about to expire. It was used for hosting my freeware which I do not maintain anymore but can still be found on shareware directories. The application points to my domain (...
2 votes
1 answer
298 views

Are authoritative nameservers vulnerable to DNS amplification/reflection or other kinds of attacks?

I have been learning about DNS over the last few days. For fun and learning, I wanted to try to set up an authoritative nameserver for my own domains. I read that creating open resolvers is generally ...
0 votes
1 answer
239 views

Since the DS recordset contains all of the child's Key Signing Key, wouldn't the DS recordset be massive and difficult to load for verification?

I'm learning about DNSSEC today but I don't quite understand about how a parent zone would store all of its child's Key Signing Keys (DNSKEY 257) in its DS record set. As far as I understand, if I ...
0 votes
1 answer
516 views

Cloudflare not hide VPS IP (ngnix)

I have a problem with hiding the VPS IP using Cloudflare. My IP can be found on search.censys.io. I don't have any DNS leaks. I'm using nginx to reverse proxy a node.js server. Is it possible to hide ...
0 votes
1 answer
2k views

Port 53 on my home router opened, why?

I couldn't find anything online so I'm here to ask experts. I've nmapped my public ip and I noticed all ports are closed but the 53. In the router's options upnp is disabled and the NAT rules are ...
4 votes
1 answer
421 views

How can I validate the root DNS key-signing-key on the command line?

Consider the following dig command and its truncated output: dig . dnskey +dnssec +multi @a.root-servers.net ... ... ;; ANSWER SECTION: . 172800 IN DNSKEY 257 3 8 ( ...
1 vote
1 answer
577 views

How does DNS prefetching endanger security/privacy?

I would like a comprehensive explanation of the security and privacy risks that come with DNS prefetching. There are already other posts about this topic, but I want current information and feedback ...
2 votes
1 answer
177 views

Is it possible for a hostname lookup to be temporarily lying (wrong ISP)?

In 2017, I was running a local website on my own dedicated server in a professional data center. FreeBSD. Installed by me remotely. Maintained carefully by me. No other human users than myself. I was ...
6 votes
3 answers
21k views

What can my ISP see in their log files if I use Google DNS?

For example, if I use my ISP DNS and open this page they will see: https://security.stackexchange.com/questions/ask It would show up in their logs for sure. But if I use Google DNS, then what ...
0 votes
0 answers
1k views

Should I be worried about Ignoring query from non-local network in dnsmasq?

I am using a DNS forwarder, it's not open to the WWW (runs only in the LAN) and in the dnsmasq logs I noticed something off: Ignoring query from non-local network Has my network been breached? ...
0 votes
1 answer
240 views

Best Practices for Securing an authoritative DNS [closed]

I am trying to implement the best practices for securing the Linux bind DNS. I have never gone this in-depth with securing authoritative DNS before. What do you recommend?
1 vote
1 answer
149 views

Flooding attacks in DNSCrypt

In order to mitigate reflection-amplification attacks, DNSCrypt seems to enforce queries that have a larger response than the query to be retransmitted over TCP. This feature will mitigate ...
0 votes
2 answers
321 views

DNS resolution attacks by flooding spoofed replies

Each DNS request has an ID of 16bits. In the event that an adversary is unable to sniff the query, a way to spoof the DNS reply is to flood the resolver with many replies. Request from victim Query ...
1 vote
2 answers
263 views

DNS hijacking/poisoning effect on URL/URI and password manager autotype/autofill

A benefit to password managers, at least some of them, is that they can look at the URL and only use autotype/autofill when on the correct site, which can help prevent pharming since if instead of ...
0 votes
2 answers
120 views

Would a signed TLS certificate prevent an attacker from stealing a domain?

I'm trying to understand how the attack described in this article could work. Let's grant that this attacker, not associated with company.com, managed to take control of oldsub.company.com. Here's a ...
4 votes
0 answers
767 views

Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable

By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A. Is there any risk to this vulnerability or ...
3 votes
1 answer
6k views

Secure DNS (DoH, DoT) differences, performance, comparison

I am reading up on secure DNS (DoH, DoT) and trying to identify its differences. Currently, I am on https://www.cloudflare.com/learning/dns/dns-over-tls/ page. Is there for example some non-...
0 votes
0 answers
69 views

Need of Transaction SIGnature (TSIG) record

Can't we simply send the shared secret key along with AXFR query? A hacker can easily use sniffed TSIG record to authenticate himself. Then how it's called SECURED zone transfer?
2 votes
2 answers
457 views

Bypass network security filters with CDN

I read about Domain Fronting technique, it bypasses network security filters but requires a relatively complex configuration (having evil.com pointing to a.cdn.net, and good.com pointing to b.cdn.net, ...
0 votes
0 answers
300 views

How can I monitor which page in the web browser is making a DNS request?

I manage a Microsoft environment and I use FortiClient EMS for our endpoint security. That system is logging blocked requests to https://h.parrable.com. As best I can tell, this is not a malicious ...

1
2 3 4 5
16