Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

0
votes
1answer
169 views

How to force users on my LAN to use a specific DNS server with arp poisoning?

I'm attempting to force all hosts on my LAN to use a specific DNS server to filter certain material, however I'm running into problems. I've had problems in the past trying to configure my router's ...
4
votes
1answer
85 views

Why does majority of the publicly routable IPs seem to have no rDNS assigned?

I built a Hilbert curve showing which IP addresses have rDNS assigned, based on one of the rDNS scan snapshots available on scans.io. I ended up getting the following (white means "assigned"): Is ...
1
vote
1answer
221 views

Change of DNS in MX records in a Wordpress site

I maintain qtechtheory.org, the website of my research group, which runs Wordpress and is hosted by BlueHost. Though we've been hit with PHP injection for several weeks, I've kept the site live since ...
19
votes
5answers
6k views

Does DNS allow third parties to register subdomains?

I have one of those questions that rely on the rule sets for DNS lookup. Let us say Person A owns the site https://www.example.com. A different person, Person B, not associated with A, attempts to ...
0
votes
1answer
59 views

How do I know if I can trust a DNS service

How can I decide if I could trust a given DNS service as a user? For example I have just seen DNS-Watch which tells me that it is secure and that they don't log anything. How can I decide if the ...
0
votes
1answer
92 views

Unexplained DNS connections on boot

I was on an Ubuntu VPS today, with a bind9 DNS server (without DNSSEC configured) installed and running. Immediately after booting the machine I ran: netstat -tanp And received this output: Proto ...
-2
votes
1answer
156 views

What is the difference between DNS flood attack and UDP flood attack?

As title says, what is the difference between DNS flood attack and UDP flood attack? Plus, do they only exhaust the network bandwidth or do they also exhaust the server-side assets such as CPU, ...
1
vote
1answer
574 views

What are the possible solution for blocking VPN connection on a home network?

I am not a techie. I am just wanting to force some parentral control using OPENDNS. Opendns works fine however it is easily broken on android or windows using vpn software like ultrasurf or latern or ...
4
votes
2answers
197 views

How can I prevent abuse of our public WiFi network?

One of our customers runs a holiday park with <100 users on it. We currently have a mikrotik in place that prevents torrenting etc, however their line has been cut off as someone there has been ...
6
votes
2answers
1k views

Strange Problem - DNS Cache Poisoning?

I'm a developer by trade, but not that well versed in information security. I've encountered a strange problem at home: About three times now in the past year, when I open some website - I'm thrown ...
2
votes
0answers
26 views

DNS search lists cause ambiguity, but what are practical examples of this?

Browsers and other Web software tend to allow the system resolver to use the local domain search list when resolving URLs. E.g. www -> www.example.com., if your domain search list is example.com. ...
2
votes
1answer
600 views

Difference between DNS flood attack and DNS amplifier attack [duplicate]

I am trying to understand DNS flood and DNS amplifier attack. I have read the definition and am still confused, could you give me an example of each attack or tell me the differences between them? It ...
38
votes
4answers
7k views

How could a public DNS server return bad results?

I live in a country which is under many sanctions. Both internal sanctions (government on people) and external sanctions (US on our people). In our country, YouTube, Twitter, Facebook and many other ...
1
vote
0answers
51 views

How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?

This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
4
votes
1answer
189 views

What information is still exposed when visiting an HTTPS website using DNS over TLS?

DNS over TLS is now supported in Android Pie, which allows a user to define a private DNS server, and by DNS providers such as CloudFlare's 1.1.1.1. This opens up the world of DNS security to more ...
1
vote
1answer
61 views

Is there any security reason to prefer local IP address over zeroconf “.local” domain name?

I have some Linux servers on my local network. When I connect to them via SSH or VNC, I can either use the local 10.0.x.x IP address my router assigns, or I can use the zeroconf "hostname.local" ...
2
votes
3answers
102 views

Whitelisting DNS vs. Packet filtering Firewall

I am an information security intern for a MSP. The company is set up to work remotely a few days a week. As I was gathering information for the assessment, I found out that one of the employees does ...
0
votes
1answer
50 views

SSL with shared webmail URL

I have an account with a shared email hosting service (e.g mailcheap) and the the webmail URL is hence https://xxx.mailcheap.co. This webmail has HTTPS. Now I created CNAME records on my domain to ...
1
vote
4answers
2k views

1.1.1.1 Cloudflare encrypted DNS.Does it still leak IP addresses?

1.1.1.1 might be encrypting the DNS request but then between my ISP and the website I'm accessing, IP addresses are exchanged.Does my ISP see the IP address of the website I'm accessing but not its ...
2
votes
0answers
255 views

How can I get Suricata to alert on 1 packet every time

I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought. ...
1
vote
1answer
206 views

Authoritative DNS server resolve also any other domain - Is that a risk?

In my organization (huge financial institute) there are 4 ns servers that are defined by NS DNS record to be the authoritative DNS servers of all of our public websites. However, I found that those ...
2
votes
1answer
102 views

Need DNS changer app (or method) which actively locks DNS servers [closed]

I have tried all methods in the following link except DNS+DNSCrypt (having issues in flashing files): https://forum.xda-developers.com/general/xda-university/guide-how-to-change-dns-android-device-...
3
votes
2answers
135 views

Possibility of business calls/leads being professionally stolen? [closed]

Is it possible our VoIP calls being redirected from our intended phone number to another phone number unknown to us? Our VoIP number is currently forwarded to mobile phones and computer phones. ...
0
votes
1answer
507 views

Check router for DNS changer virus

I want to verify that router was not affected by DNS changer virus. Router provided by local Internet provider, runs custom firmware with web admin which does not contain DNS settings, no telnet/ssh/...
1
vote
1answer
149 views

Is it bad to use DKIM DNS without signing mails?

Does it provide any trust at all to have DKIM set up correctly in my DNS but not sign any emails? I could not find any information about that. Now, if I send an email to a domain/server with DMARC ...
1
vote
1answer
178 views

How does faked DNS manage to downgrade preloaded HSTS?

Yesterday, in a bid to entertain myself for a while, I was playing around with DNS servers. I set up a DNS server locally, which I then set as my primary DNS server. Within it, I added some records ...
-3
votes
1answer
75 views

What is the difference between these DNS? Which one is more NSA-proof? [closed]

What is the difference between these DNS servers: 8.26.56.26/8.20.247.20 vs 156.154.70.22/156.154.71.22 Main purpose of using is top anonymity and privacy and security. thnx
7
votes
1answer
1k views

Why are we developing both DNS over TLS & DNS over HTTPS?

Since both encrypt DNS queries, why are both DNS over TLS & DNS over HTTPS being developed? What does one offer that the other does not, if anything?
0
votes
1answer
216 views

third party DNS over ISP DNS - privacy issue

How does using third party DNS like cloudfare 1.1.1.1 DNS helps to protect privacy when ultimately ALL traffics goes through ISP? ISP is the middle man between me and the internet. Since DNS is in ...
1
vote
1answer
123 views

DNSSEC - does the domain owner owns a key?

The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS ...
0
votes
1answer
1k views

Vulnerabilities of DNS when utilized on a TCP port

There was some specific cyber security challenge (Cyber Cube 2018, GE). In one of the tasks, objective was to gain the access to some specific file that server included. After successfully solving ...
0
votes
1answer
2k views

dnsspoof doesn't spoof DNS request with IP-address of local machine

I want to spoof all DNS requests with the IP address of my local machine. However, running dnsspoof, all clients receive the real IP address and not the fake IP address of my host. I know I can ...
6
votes
2answers
1k views

Why is my Windows desktop using a DNS Server on localhost?

I recently inherited a corporate network and one of the devices kept having errors connecting to mapped network drives with errors pertaining to the server time being different than the computer's ...
0
votes
1answer
818 views

How does Domain Fronting work in practice

While reading about Domain Fronting (and Google and Amazon's decision to ban it), I came across this blog where the author has identified domains that allow fronting. From the blog, doing something ...
0
votes
1answer
173 views

Is there any advantage to using encrypted DNS on a VPN server

I have a personal OpenVPN server. I am worried that the fact the DNS resolution coming out of the server isn't encrypted, since I am the only one that uses the server at the moment, attribution isn't ...
2
votes
2answers
4k views

Connecting to my VPN via IP or domain name?

Background: So I use a private VPS to host my own VPN, rather than pay/trust another company to host it for me. I am an intermittent traveller so it is cheaper for me to spin up or down my server as ...
5
votes
1answer
334 views

How DNS hijacking was myetherwallet.com fault even though AWS DNS server was hijacked yesterday

I have been reading on how myetherwallet was hacked a day ago because Amazons domain service was compromised, as mentioned here, https://www.reddit.com/r/ethereum/comments/8ek86t/...
2
votes
0answers
1k views

dnsspoof and bettercap not dns-spoofing

I want to dns spoof my own phone, because I feel like it would be a cool experiment to do. It's not working (damn phone keeps connecting to the internet), and I would really appreciate any suggestions ...
8
votes
1answer
382 views

How to obtain privacy and authenticity with DNS?

I use pfSense (Unbound) as my local resolver. Historically I've pointed it at root recursive resolution, because I perceived my main threat as trustworthiness and recency of data (poisoned/invalid DNS)...
3
votes
1answer
368 views

What information does a private DNS prevent my ISP from seeing? [duplicate]

Forgive me for the simple question, I have very little knowledge about networks. The new DNS service from Cloudflare claims to offer a "more private" connection but I don't understand if/how it can ...
4
votes
1answer
197 views

Are browsers still vulnerable to IDN homograph attacks?

Is it not possible for Chrome and Firefox to protect against this > https://www.аррӏе.com/ Navigating to that above (fake) apple website using Firefox 59.0.2 doesn't actually take me to the apple ...
2
votes
1answer
224 views

DNS flood vs DNS Amplification attack: How is one considered a network/transport layer attack and the other a application layer attack?

I am reading a survey on DDoS attacks and they describe how these attacks can be classified by either Network/Transport level attacks and Application level attacks. In their examples, they classify ...
2
votes
0answers
207 views

Mitigating reverse DNS lookup danger / exploitation

I have read several posts indicating that reverse dns lookup cannot be trusted, as someone can spoof DNS -- so when a rule is made that allows traffic through dns, its possible to exploit. However, ...
2
votes
1answer
240 views

What are the potential risks of performing DNS queries on unknown domains?

When investigating malicious domains that are used for phishing, malware, etc, you often have to issue DNS queries for these domains. For example: dig @1.1.1.1 example.com The potential risks of ...
1
vote
0answers
157 views

Why ever “trust” Nmap's reverse lookup for system hostname when doing host discovery?

Quick question. I was scanning a lab network with Nmap just doing host discovery to see what hosts were out there. I got a list of hosts, ips, hostnames, ports open, services, etc. Upon further ...
-3
votes
1answer
150 views

Is YouTube DNS actually revealing the full domain?

I have heard that YouTube, including their iPhone app, is encrypted by using TLS (HTTPS). So that means the DNS packet should only reveal the base domain, like youtube.com. However, while testing ...
0
votes
1answer
37 views

Interconnected DNS Information [closed]

So, one of the methods to verify if a domain is legitimate or not is to check out it's DNS records and their interconnection. The ones I could find are. NS and PTR record A and AAAA pointing to ...
1
vote
2answers
472 views

What can I do to prevent BGP hijacking as an admin of some OVH's VPS?

I am an operator of some public service which is run on some OVH's VPS. Recently I was contacted by an anonymous contact, who suggested that the service was BGP-hijacked and some sensitive info of ...
1
vote
1answer
118 views

Disabling external DNS lookups - is this really so beneficial for security?

I have recently started working for a company which disables external DNS resolution from the machines inside the network by not adding external forwarders to the internal DNS servers - the reasoning ...
-4
votes
1answer
443 views

How does resolv.conf work? [closed]

Can someone try explaining (in simple terms) how Wi-Fi routers push nameservers and routes to my resolv.conf? I've noticed it gets changed automatically as I move between different Wi-Fi networks. I ...