Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

Filter by
Sorted by
Tagged with
1
vote
1answer
44 views

Interconnected DNS Information [closed]

So, one of the methods to verify if a domain is legitimate or not is to check out it's DNS records and their interconnection. The ones I could find are. NS and PTR record A and AAAA pointing to ...
1
vote
2answers
521 views

What can I do to prevent BGP hijacking as an admin of some OVH's VPS?

I am an operator of some public service which is run on some OVH's VPS. Recently I was contacted by an anonymous contact, who suggested that the service was BGP-hijacked and some sensitive info of ...
1
vote
1answer
131 views

Disabling external DNS lookups - is this really so beneficial for security?

I have recently started working for a company which disables external DNS resolution from the machines inside the network by not adding external forwarders to the internal DNS servers - the reasoning ...
-4
votes
1answer
468 views

How does resolv.conf work? [closed]

Can someone try explaining (in simple terms) how Wi-Fi routers push nameservers and routes to my resolv.conf? I've noticed it gets changed automatically as I move between different Wi-Fi networks. I ...
138
votes
3answers
26k views

Did I just get DNS Hijacked?

I went online on my Macbook today and noticed my iTunes complaining that it couldn't connect to Apple, I tried logging out and in of my account but weirdly it said it couldn't log in; I didn't think ...
2
votes
1answer
244 views

How many times does a DNS server need to sign?

I have a question about DNSSEC and how many times a DNS server must sign or in other words, how many signatures are there in a day. I know that DNSSEC builds on a chain of trust starting at the root ...
1
vote
1answer
516 views

Can I use BIND in place of DNSCrypt? [closed]

I was using DNSCrypt on my personal computer (linux). I uninstalled it, and now I'm getting errors reinstalling. I believe development on DNSCrypt was being abandoned anyway, because Cisco/OpenDNS ...
17
votes
1answer
2k views

Why don't browsers check CAA records to help ensure a certificate is valid?

If I understand correctly, Certification Authority Authorization DNS records are used to specify which certificate authorities are allowed to issue certificates for a given domain. If that record ...
7
votes
2answers
4k views

What is the best way of finding subdomains of a domain?

I need to find most subdomains of a domain. I know there are many options. I've tried many available in Kali Linux: dnsmap dnsenum dnsrecon dnswalk fierce urlcrazy Most of them only find 2 or 3 ...
2
votes
2answers
287 views

do SRV records make a system more vulnerable or expose too much

We are all pretty comfortable with the fact that if ports 80 and 443 are open that these are for http even though some companies block 22 forcing people to repurpose 443 for ssh. So, those instances ...
2
votes
1answer
452 views

Does Chrome respect the X-DNS-Prefetch-Control header?

If my web page returns X-DNS-Prefetch-Control=off, will Chrome do DNS prefetch for links like these?: <link rel="dns-prefetch" href="http://www.spreadfirefox.com/"> I know Firefox and Chromium ...
0
votes
1answer
101 views

Establishinig TLS session with HTTP server after DNS-over-TLS

I just learned about DNS-over-TLS from IETF. I need clarification in some points to get the whole picture. Assume there is a client want to connect to a TLS server and use DNS-over-TLS as well. The ...
2
votes
1answer
105 views

Is it safe to post the output of Linux dig (DNS) commands?

I need help debugging/troubleshooting a DNS/DKIM issue over on ServerFault, but it looks like I need to paste the results of running: dig my-dns-record.example.com CNAME ...where my-dns-record....
1
vote
2answers
164 views

Active Directory DNS server security misconfiguration or an acceptable practice?

I work for a large Eastern European bank as a programmer. Recently, I was setting up a documentation website for my team. We came up with the host name, and now all we needed was to pick the best ...
0
votes
2answers
252 views

Which SPF quantifier applies when an SPF include is used?

An SPF record has several tags of which one can be the include tag, and the SPF record ends with a quantifier like +, ?, ~ or -. When an include tag is used, the included SPF record has it’s own SPF ...
1
vote
2answers
4k views

Do SPF records apply to all subdomains?

Does a SPF record apply only on the domain it’s setup for or also for all it’s subdomains? For example an SPF record that is configured for the domain example.com will set the policy for mails ending ...
0
votes
2answers
263 views

Is DANE the DNS-variant of HTTP Public Key Pinning (HPKP)?

I’m trying to understand DANE and TLSA records more accurately. Is it fair to call DANE the DNS-variant of (or at least a very similar technique to) HTTP Public Key Pinning (HPKP)? Because with HPKP ...
1
vote
1answer
56 views

Does flushing DNS help with your anonymity?

Some had said that flushing DNS could help you stay more anonymous but is this claim legit? I know for sure that webpages can see the DNS servers you're using but could they see your DNS cache? Where ...
1
vote
1answer
235 views

Server get flooded by Avast Secure DNS

My server is getting flooded by Avast Secure DNS. This was generating high I/O while writing lots of entries in daemon.log and syslog files. Thank to fail2ban, I was able to ban those IP and get the ...
17
votes
1answer
2k views

Should OS information be in DNS?

We are having an internal discussion about system naming conventions and there is a disagreement about including the type of OS a system is running in the DNS host record. One suggestion was to ...
1
vote
1answer
72 views

Is OSX/MaMi a real malware or a simple filtering software?

Recently a lot of communications spread starting from this analysis: OSX/MaMi analysis When I read this analysis, I found that 2 DNS servers are defined as default ones for the IP configuration: 82....
4
votes
1answer
2k views

ARP spoofing with Scapy. How does Scapy reroute traffic?

Background: I understand that in order to ARP spoof a victim in a network using Scapy, we need to send ARP reply packets to the victim and the gateway router with the correct destination and Source ...
4
votes
2answers
1k views

Detecting C2 traffic over DNS?

Let's assume I have a large enterprise network (thousands of nodes) and somewhere on that network there is malware communicating over DNS for C2. Let's assume the requests are designed such that the ...
2
votes
1answer
151 views

DNS spoofing+firewall port hijack/redirect to capture HTTPS requests without getting “certificate untrusted error” on the client browser [duplicate]

If i could setup a DNS server that responds with my server's IP for a certain domain, along with redirecting https and all DNS queries requests to my local https site and my local DNS server ...
4
votes
2answers
3k views

How to hide dns requests from ISP?

I am using google image a lot. I discovered through Wireshark, any images under preview mode of google images search result actually expose the dns where that image was hosted from. For example, my ...
2
votes
2answers
414 views

Protecting yourself from DNS spoof

How does one protect themself from a DNS compromised site, which also has had their SSL private key stolen? Short of monitoring which IP the packets are being sent to. Edit: Or even without the ...
-2
votes
1answer
153 views

DNS Request makes Google Image Unsafe to Use

I always thought the images from Google image search were under the domain of Google URLs. As long as you don’t click the image to visit the original site that hosts that picture, you were with ...
1
vote
4answers
726 views

Difference between whois of a hostname and an IP [closed]

I was reading through No Starch's Metasploit book when I came across a segment which showed the results of running the 'whois' command on a hostname and then on it's corresponding IP only to yield ...
0
votes
1answer
85 views

Where or how can I get list of domain dependencies of top 100 popular sites? [closed]

For example google.com depends on ssl.gstatic.com, lh3.googleusercontent.com, fonts.gstatic.com. I need this list for Proxy settings
3
votes
0answers
35 views

Can some combinations of DNS-entries be security vulnerabilities?

Lets assume you have these DNS-entries for domain.tld: host = domain.tld type = SOA mname = dns.otherdomain.tld rname = hostmaster.otherdomain.tld host = domain.tld type = NS target = ns1....
0
votes
2answers
444 views

If ssl certs authenticate the servers ip address, how come I can't find a whitelisted ip address in any secure certs or am i looking in wrong place?

UPDATE This question is illogical. Https does not authenticate the IP address I was wrong. I guess my question (should have been) how can I verify the server's IP from the cert? I thought that was an ...
3
votes
1answer
1k views

How does CleanBrowsing DNS servers make 'Youtube, Google and Bing forced to SafeMode'?

Quote from Activating CleanBrowsing Activating CleanBrowsing is pretty simple and only takes 5 minutes. We do our work via DNS, so you have to switch your DNS servers to go through our Network ...
54
votes
3answers
13k views

Is my Windows 10 machine experiencing DNS poisoning? I keep getting Chinese IP addresses when connecting to a U.S. government domain

I've found that some .gov sites are being redirected to a Chinese IP. I have searched across Internet to see if this a known form of malware but I'm unable to find any info. I would like someone ...
-2
votes
1answer
413 views

In DNS Tunneling, What's the DNS Response packet size?

In DNS Tunneling server use RR (CNAME, TXT, NULL) to send back data to the client. My question is what's the size of response packet and how much data can be sent using DNS response in DNS Tunnel ?
1
vote
1answer
132 views

Is this VPN customer service info correct?

I have recently started using a VPN. I visited dnsleak.com and dnsleaktest.com and was informed by both of these sites that my DNS was leaking. Indeed, I could see in the list of servers, that a ...
-3
votes
3answers
189 views

Why can I access a website using its domain name but I cannot when using its IP address directly? [closed]

For my target domain e.g. www.domain.com I find the ip address with ping command but if I browse directly the ip address I obtain an error page. How is it possible? I know that problably the service ...
-1
votes
1answer
260 views

Can I perform a local test for DNS leaking?

I want to test that the connection from my local machine to my VPN is set up correctly, specifically that I do not have DNS leaks. I am aware of web-based tools like dnsleaktest.com but they aren't ...
1
vote
1answer
2k views

DNS leak with proxychains and firefox

When using firefox with proxychains - (default configuration file with tor: socks4 127.0.0.1 9050) and checking on dnsleaktest.com, the original lookup returns the proxied IP, but when performing ...
2
votes
2answers
242 views

How can a website find an IP behind a proxy using DNS methods?

I read a whitepaper from Iovation in which they discussed unmasking the IP behind a proxy. "The method wherein the connecting host is an anonymizing proxy or intermediate device, measuring ...
1
vote
1answer
630 views

Will changing the Wifi router fix a hijacked Wifi problem? [closed]

The other day, I was browsing casually through the web with my laptop. I visited a site that somehow managed to open a popup ad under my notice. This popup ad site I think has malware written all ...
-2
votes
1answer
244 views

Where is payload reside in a DNS frame when tunneling? [closed]

Can anyone explain me about DNS tunneling? where the TCP/IP packet or payload data injected in a DNS frame? How data get decapsulated in the server side? Explain DNS frame?
3
votes
1answer
66 views

Redirected to unsafe page on freshly installed Windows 10

This is my first question in security, so let me know if something about the question should be fixed. Some background information: My Windows 10 laptop was starting to get realy, realy slow when ...
2
votes
2answers
130 views

Is allowing public access to a DNS server, a security threat?

If i was to create a DNS server that is hosted at my home, so then i can use it for my VPS servers; am I creating any security threat that can be abused by unknown clients from around the globe? TL;...
2
votes
0answers
28 views

Can another user on my WPA2 WiFi network see my DNS requests? [duplicate]

On a WiFi network with WPA2 security, can another device see the DNS requests that my device makes? My understanding is that with HTTPS, no-one can see the content or full URLs that I connect to. ...
0
votes
2answers
159 views

Why don't more DGA malware families use word-lists?

Of all the known malware families that use DGAs to communicate with their C2, only very few use DGAs that generate non-random-looking domain names. For example, Suppobox generates domain names by ...
6
votes
1answer
4k views

How can I look up a Certificate Authorities CAA record value?

I'd like to publish a CAA record for a domain and while I am familiar with the format I do not know what to use for the value. For example, Comodo certs would use 0 issue "comodoca.com" and Certbot ...
1
vote
0answers
146 views

DNS Leak Detection

While checking my personal VPN server for DNS leaks (and finding them), it got me thinking. If I'm a network owner who hosts a website, and I sniff and log all in/outbound on my web servers, is there ...
0
votes
2answers
328 views

resolv.conf: my router acts as a nameserver - a vulnerability? How to change it?

I'm running Debian 9.1 with KDE and when connecting to the Internet by default I get these two lines in my /etc/resolv.conf file: search localdomain nameserver {ipofmyrouter} I guess that these - or ...
1
vote
1answer
469 views

Getting lots of NXDOMAIN response

Currently I am analyzing the DNS logs from various Windows servers. I am seeing lots of NXDOMAIN response from the DNS server. When I looked into the query field, it is something like '...
1
vote
1answer
81 views

Is there a passive way to verify DKIM implementations (on DNS level) without triggering an actual email event?

I wondered if there is a way to verify the correctness/validity of DKIM implementations without actually triggering an email event or sending an email to an external validator. So, remotely, on any ...