Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

138
votes
3answers
26k views

Did I just get DNS Hijacked?

I went online on my Macbook today and noticed my iTunes complaining that it couldn't connect to Apple, I tried logging out and in of my account but weirdly it said it couldn't log in; I didn't think ...
1
vote
1answer
190 views

How many times does a DNS server need to sign?

I have a question about DNSSEC and how many times a DNS server must sign or in other words, how many signatures are there in a day. I know that DNSSEC builds on a chain of trust starting at the root ...
1
vote
1answer
471 views

Can I use BIND in place of DNSCrypt? [closed]

I was using DNSCrypt on my personal computer (linux). I uninstalled it, and now I'm getting errors reinstalling. I believe development on DNSCrypt was being abandoned anyway, because Cisco/OpenDNS ...
17
votes
1answer
1k views

Why don't browsers check CAA records to help ensure a certificate is valid?

If I understand correctly, Certification Authority Authorization DNS records are used to specify which certificate authorities are allowed to issue certificates for a given domain. If that record ...
6
votes
4answers
4k views

What is the best way of finding subdomains of a domain?

I need to find most subdomains of a domain. I know there are many options. I've tried many available in Kali Linux: dnsmap dnsenum dnsrecon dnswalk fierce urlcrazy Most of them only find 2 or 3 ...
3
votes
2answers
247 views

do SRV records make a system more vulnerable or expose too much

We are all pretty comfortable with the fact that if ports 80 and 443 are open that these are for http even though some companies block 22 forcing people to repurpose 443 for ssh. So, those instances ...
2
votes
1answer
419 views

Does Chrome respect the X-DNS-Prefetch-Control header?

If my web page returns X-DNS-Prefetch-Control=off, will Chrome do DNS prefetch for links like these?: <link rel="dns-prefetch" href="http://www.spreadfirefox.com/"> I know Firefox and Chromium ...
0
votes
1answer
101 views

Establishinig TLS session with HTTP server after DNS-over-TLS

I just learned about DNS-over-TLS from IETF. I need clarification in some points to get the whole picture. Assume there is a client want to connect to a TLS server and use DNS-over-TLS as well. The ...
2
votes
1answer
105 views

Is it safe to post the output of Linux dig (DNS) commands?

I need help debugging/troubleshooting a DNS/DKIM issue over on ServerFault, but it looks like I need to paste the results of running: dig my-dns-record.example.com CNAME ...where my-dns-record....
1
vote
2answers
156 views

Active Directory DNS server security misconfiguration or an acceptable practice?

I work for a large Eastern European bank as a programmer. Recently, I was setting up a documentation website for my team. We came up with the host name, and now all we needed was to pick the best ...
0
votes
2answers
209 views

Which SPF quantifier applies when an SPF include is used?

An SPF record has several tags of which one can be the include tag, and the SPF record ends with a quantifier like +, ?, ~ or -. When an include tag is used, the included SPF record has it’s own SPF ...
1
vote
2answers
3k views

Do SPF records apply to all subdomains?

Does a SPF record apply only on the domain it’s setup for or also for all it’s subdomains? For example an SPF record that is configured for the domain example.com will set the policy for mails ending ...
0
votes
2answers
240 views

Is DANE the DNS-variant of HTTP Public Key Pinning (HPKP)?

I’m trying to understand DANE and TLSA records more accurately. Is it fair to call DANE the DNS-variant of (or at least a very similar technique to) HTTP Public Key Pinning (HPKP)? Because with HPKP ...
1
vote
1answer
54 views

Does flushing DNS help with your anonymity?

Some had said that flushing DNS could help you stay more anonymous but is this claim legit? I know for sure that webpages can see the DNS servers you're using but could they see your DNS cache? Where ...
1
vote
1answer
227 views

Server get flooded by Avast Secure DNS

My server is getting flooded by Avast Secure DNS. This was generating high I/O while writing lots of entries in daemon.log and syslog files. Thank to fail2ban, I was able to ban those IP and get the ...
11
votes
1answer
1k views

Should OS information be in DNS?

We are having an internal discussion about system naming conventions and there is a disagreement about including the type of OS a system is running in the DNS host record. One suggestion was to ...
1
vote
1answer
69 views

Is OSX/MaMi a real malware or a simple filtering software?

Recently a lot of communications spread starting from this analysis: OSX/MaMi analysis When I read this analysis, I found that 2 DNS servers are defined as default ones for the IP configuration: 82....
4
votes
1answer
2k views

ARP spoofing with Scapy. How does Scapy reroute traffic?

Background: I understand that in order to ARP spoof a victim in a network using Scapy, we need to send ARP reply packets to the victim and the gateway router with the correct destination and Source ...
4
votes
2answers
1k views

Detecting C2 traffic over DNS?

Let's assume I have a large enterprise network (thousands of nodes) and somewhere on that network there is malware communicating over DNS for C2. Let's assume the requests are designed such that the ...
2
votes
1answer
141 views

DNS spoofing+firewall port hijack/redirect to capture HTTPS requests without getting “certificate untrusted error” on the client browser [duplicate]

If i could setup a DNS server that responds with my server's IP for a certain domain, along with redirecting https and all DNS queries requests to my local https site and my local DNS server ...
3
votes
2answers
3k views

How to hide dns requests from ISP?

I am using google image a lot. I discovered through Wireshark, any images under preview mode of google images search result actually expose the dns where that image was hosted from. For example, my ...
2
votes
2answers
393 views

Protecting yourself from DNS spoof

How does one protect themself from a DNS compromised site, which also has had their SSL private key stolen? Short of monitoring which IP the packets are being sent to. Edit: Or even without the ...
-2
votes
1answer
151 views

DNS Request makes Google Image Unsafe to Use

I always thought the images from Google image search were under the domain of Google URLs. As long as you don’t click the image to visit the original site that hosts that picture, you were with ...
1
vote
4answers
663 views

Difference between whois of a hostname and an IP [closed]

I was reading through No Starch's Metasploit book when I came across a segment which showed the results of running the 'whois' command on a hostname and then on it's corresponding IP only to yield ...
0
votes
1answer
85 views

Where or how can I get list of domain dependencies of top 100 popular sites? [closed]

For example google.com depends on ssl.gstatic.com, lh3.googleusercontent.com, fonts.gstatic.com. I need this list for Proxy settings
3
votes
0answers
35 views

Can some combinations of DNS-entries be security vulnerabilities?

Lets assume you have these DNS-entries for domain.tld: host = domain.tld type = SOA mname = dns.otherdomain.tld rname = hostmaster.otherdomain.tld host = domain.tld type = NS target = ns1....
0
votes
2answers
374 views

If ssl certs authenticate the servers ip address, how come I can't find a whitelisted ip address in any secure certs or am i looking in wrong place?

UPDATE This question is illogical. Https does not authenticate the IP address I was wrong. I guess my question (should have been) how can I verify the server's IP from the cert? I thought that was an ...
3
votes
1answer
1k views

How does CleanBrowsing DNS servers make 'Youtube, Google and Bing forced to SafeMode'?

Quote from Activating CleanBrowsing Activating CleanBrowsing is pretty simple and only takes 5 minutes. We do our work via DNS, so you have to switch your DNS servers to go through our Network ...
54
votes
3answers
13k views

Is my Windows 10 machine experiencing DNS poisoning? I keep getting Chinese IP addresses when connecting to a U.S. government domain

I've found that some .gov sites are being redirected to a Chinese IP. I have searched across Internet to see if this a known form of malware but I'm unable to find any info. I would like someone ...
-2
votes
1answer
367 views

In DNS Tunneling, What's the DNS Response packet size?

In DNS Tunneling server use RR (CNAME, TXT, NULL) to send back data to the client. My question is what's the size of response packet and how much data can be sent using DNS response in DNS Tunnel ?
1
vote
1answer
129 views

Is this VPN customer service info correct?

I have recently started using a VPN. I visited dnsleak.com and dnsleaktest.com and was informed by both of these sites that my DNS was leaking. Indeed, I could see in the list of servers, that a ...
-3
votes
3answers
174 views

Why can I access a website using its domain name but I cannot when using its IP address directly? [closed]

For my target domain e.g. www.domain.com I find the ip address with ping command but if I browse directly the ip address I obtain an error page. How is it possible? I know that problably the service ...
-1
votes
1answer
250 views

Can I perform a local test for DNS leaking?

I want to test that the connection from my local machine to my VPN is set up correctly, specifically that I do not have DNS leaks. I am aware of web-based tools like dnsleaktest.com but they aren't ...
1
vote
1answer
2k views

DNS leak with proxychains and firefox

When using firefox with proxychains - (default configuration file with tor: socks4 127.0.0.1 9050) and checking on dnsleaktest.com, the original lookup returns the proxied IP, but when performing ...
2
votes
2answers
232 views

How can a website find an IP behind a proxy using DNS methods?

I read a whitepaper from Iovation in which they discussed unmasking the IP behind a proxy. "The method wherein the connecting host is an anonymizing proxy or intermediate device, measuring ...
1
vote
1answer
602 views

Will changing the Wifi router fix a hijacked Wifi problem? [closed]

The other day, I was browsing casually through the web with my laptop. I visited a site that somehow managed to open a popup ad under my notice. This popup ad site I think has malware written all ...
-2
votes
1answer
238 views

Where is payload reside in a DNS frame when tunneling? [closed]

Can anyone explain me about DNS tunneling? where the TCP/IP packet or payload data injected in a DNS frame? How data get decapsulated in the server side? Explain DNS frame?
3
votes
1answer
65 views

Redirected to unsafe page on freshly installed Windows 10

This is my first question in security, so let me know if something about the question should be fixed. Some background information: My Windows 10 laptop was starting to get realy, realy slow when ...
2
votes
2answers
129 views

Is allowing public access to a DNS server, a security threat?

If i was to create a DNS server that is hosted at my home, so then i can use it for my VPS servers; am I creating any security threat that can be abused by unknown clients from around the globe? TL;...
2
votes
0answers
28 views

Can another user on my WPA2 WiFi network see my DNS requests? [duplicate]

On a WiFi network with WPA2 security, can another device see the DNS requests that my device makes? My understanding is that with HTTPS, no-one can see the content or full URLs that I connect to. ...
0
votes
2answers
148 views

Why don't more DGA malware families use word-lists?

Of all the known malware families that use DGAs to communicate with their C2, only very few use DGAs that generate non-random-looking domain names. For example, Suppobox generates domain names by ...
6
votes
1answer
3k views

How can I look up a Certificate Authorities CAA record value?

I'd like to publish a CAA record for a domain and while I am familiar with the format I do not know what to use for the value. For example, Comodo certs would use 0 issue "comodoca.com" and Certbot ...
1
vote
0answers
145 views

DNS Leak Detection

While checking my personal VPN server for DNS leaks (and finding them), it got me thinking. If I'm a network owner who hosts a website, and I sniff and log all in/outbound on my web servers, is there ...
0
votes
2answers
297 views

resolv.conf: my router acts as a nameserver - a vulnerability? How to change it?

I'm running Debian 9.1 with KDE and when connecting to the Internet by default I get these two lines in my /etc/resolv.conf file: search localdomain nameserver {ipofmyrouter} I guess that these - or ...
1
vote
1answer
446 views

Getting lots of NXDOMAIN response

Currently I am analyzing the DNS logs from various Windows servers. I am seeing lots of NXDOMAIN response from the DNS server. When I looked into the query field, it is something like '...
1
vote
1answer
80 views

Is there a passive way to verify DKIM implementations (on DNS level) without triggering an actual email event?

I wondered if there is a way to verify the correctness/validity of DKIM implementations without actually triggering an email event or sending an email to an external validator. So, remotely, on any ...
-1
votes
1answer
3k views

How do you encrypt DNS traffic in 2017? [closed]

I have seen a couple of questions on here today that recommend DNScrypt for encrypting DNS traffic. However, I feel a little bit of gut inertia that this is not good enough for 2017. What tools do ...
0
votes
1answer
764 views

Is SSL + DNScrypt enough to hide visited domains from my ISP?

I've been using VPN lately which I configured on Ubuntu machine in Germany, and I do not feel comfortable using it because of high latency. So I found DNScrypt. Since I only want to keep my browsing ...
2
votes
2answers
191 views

DNS Poisoning - How to edit the “list” it in the target server?

I know how to redirect some DNS name to another DNS name. For example, access security.stackexchange.com and redirect to facebook.com. But I am doing this with my own server and the connected ...
0
votes
2answers
126 views

Should entire domains always be blacklisted?

I'm working on a team for an enterprise network security product and we're implementing white/blacklisting as part of the program. We have lists that were taken from a third-party source but nobody ...