Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

12
votes
3answers
593 views

Should the average user care about DNS security?

Denise is an average user who goes with the default settings of her OS and home router. She knows that her browser and email client use DNS and she's worried because I told her that the DNS protocol ...
3
votes
4answers
302 views

Preventing phishing / spear phishing of employees

We get a lot of targeted phishing emails to our employees, semi-sophisticated ones where they speak about a project or give an outline brief. We then get back to them and they send us an 'attached PDF'...
1
vote
0answers
204 views

Why isn't encrypted DNS more widely adopted? [closed]

Considering recent (and arguably successful, if slow because of their large scale) efforts to make encrypted HTTP communication ubiquitous using SSL/TLS via such CAs as Let's Encrypt, and the presence ...
0
votes
2answers
728 views

When using an SSH tunnel does the server resolve domain names or is it still done via the ISP/DNS server on the router?

With the recent UK news on the snoopers charter ISP's will be able to log and store a users Internet activities for up to a year and be made available to the Government. I've started thinking about ...
2
votes
0answers
418 views

UK ISP Snoopers Bill and DNS [closed]

The United kingdom now has one of Europe's if not the world's worst overt personal privacy laws. All Internet service providers must now as standard log every website visited with a rolling time frame ...
1
vote
0answers
46 views

Forwarding requests to known suspicious site to an isolated server

I keep getting IPS alerts for suspicious DNS requests for a known host with malware. I can't find anything from the Windows DNS logs from the domain controllers because it just shows the source ...
-1
votes
2answers
183 views

Is there a way to “manipulate” my location without third parties knowing it? (when i am logged in to my google account) [closed]

Is there a way to "manipulate" my location (IP address) without third parties knowing it? (when i am logged in to my google account)
2
votes
1answer
156 views

How does DNS / router safety checking work?

Tools such as this are used to check whether your router is infected with malware that redirects your traffic via bad guys' DNS servers. How can these tools tell which DNS servers are actually used ...
1
vote
1answer
35 views

MX records being linked to spamming?

I have seen a rule in an environment that detects DNS MX query types going from an internal source to an external, none SMTP server. The justification states that this could be indicative of malware ...
1
vote
0answers
43 views

WordPress site sends email from strange domains

I had a WordPress site with a security plugin configured to send me periodical database backups via email. This morning I noticed that I was receiving these emails as coming from two strange domains I ...
1
vote
2answers
513 views

Is reverse DNS a must have to prevent emails delivered as spam?

I was considering setting up my own mail server and one of the things I've read about is that I must setup reverse DNS to do not get caught by a spam filter. Is that really a must? Aren't SPF and ...
0
votes
1answer
146 views

How DNS blacklisting works?

Let's say we have this network setup: PC > Firewall > DNS Server I was under the impression that the PC would attempt to access the DNS server but the firewall would instantly block the request ...
0
votes
2answers
96 views

Find DNS Server of an IP over Internet [closed]

I know that many clients in the same network has a same DNS (Most of time but it can be changed.) But is there anyway to understand what DNS Server that an specific IP (Over Internet) uses through ...
5
votes
2answers
160 views

How can I (preferably metaphorically) explain DNSSEC without technical jargon?

How can I explain a non-technical person the purpose of Domain Name System Security Extensions (DNSSEC) and the risks of not using DNSSEC? It would be nice to use a metaphor, so that it's also easy to ...
-1
votes
2answers
132 views

The solution to the Dyn DNS attack is alternate servers?

The solution to the Dyn DNS attack is probably having alternate DNS services, right? If our ISP's DNS servers are hit with DDOS, can I just fire up my alternate DNS, which is either hosted by us or ...
5
votes
1answer
695 views

DNS Flood using DNS Amplification?

So, a DNS Flood is when you DDOS a DNS Server, and a DNS Amplification is when you use the DNS Server to execute a DOS attack (I think). Based on recent events (the attack to Dyn's DNS service) I was ...
6
votes
3answers
426 views

Did the October 21, 2016 DDoS attack on Dyn's DNS service cause Bandwidth Exhausion?

A recent attack on Dyn's DNS services affected several major websites last Friday, Oct 21, 2016. I would be interested to know if this was Bandwidth Exhaustion, or if it was mainly load on the server ...
7
votes
1answer
4k views

What's the difference between A and AAAA DNS records? [closed]

Dnsmasq logs show that A and AAAA records are being transmitted/received. What is the difference between to these two types of DNS records (A and AAAA)? Can either be rejected/dropped/ignored? (...
53
votes
6answers
8k views

Why don't browser DNS caches mitigate DDOS attacks on DNS providers?

Why are the recent DDoS attack against DNS provider Dyn, and other similar attacks successful? Sure a DDoS attack can bring an entity down, and if that entity controls DNS servers then queries to ...
5
votes
1answer
525 views

How to access sites whose DNS server is under attack?

As many of you noticed, last night's DDoS attack against Dyn.com made many major services unavailable, including Twitter and Spotify. Spending one Friday evening without Twitter was enough and I want ...
4
votes
2answers
214 views

Why would attacking a DNS server have the affects it did?

I'm somewhat confused as to the technical details of the Oct. 21 DDoS. Dyn is a company, which according to wikipedia is an Internet performance management company, offering products to monitor, ...
8
votes
3answers
924 views

Why was October 2016 Dyn attack limited to East Coast?

Maps on the Internet showed that the focus of the Dyn DDoS attack was on the East Coast of the US. But why? My DNS provider is not on the East Coast and I am located in Colorado. My DNS is 8.8.8.8 (...
0
votes
2answers
236 views

DNS Spoof saves IP to Domain Name after attack is finished, Is there a way to stop this?

As I understand after a Domain Name is resolved to a specefic IP through DNS www.example.com resolves to 10.10.10.10, this cache is saved in RAM in a computer for a little bit, AKA five or so minutes. ...
4
votes
3answers
1k views

MX record security

In theory, are MX records more susceptible to spammers than A records for mail servers? If a mail server only has an A record, provided the SMTP service is running, mail will still be delivered. Now I ...
0
votes
3answers
407 views

Can ICANN deny Internet service to people? [closed]

I had an argument with a co-worker yesterday about the recent transfer of the administration of ICANN. My co-worker said that, since ICANN has control over the assignment of (a) IP addresses and (b) ...
4
votes
1answer
105 views

I was the subject of a low-impact DNS attack. What do I need to do?

Recently, my website was subject to a DNS attack of sorts. I have my domain name (which I won't say here but should be pretty easy to find if you're interested) registered with Hostgator and set up ...
5
votes
1answer
949 views

Does the Tor Browser leak a list of visited websites to TLD DNS services?

Over here, it came up that the operator of a web service can find out the real IP address of a Tor Browser user by simply letting the user resolve a subdomain via a HTML element and logging who (...
2
votes
1answer
188 views

How can I prove that mail sent was NOT caused by the newly deployed DMARC policy?

I understand that by publishing an initial p=none policy, you basically instruct recipients that participate in DMARC to NOT treat incoming mail any different than how they did before a DMARC policy ...
1
vote
2answers
126 views

Can a DNS provider take action if a phishing attempt comes from one of their domains?

I received a delightful phishing attempt: Please keep this email for your crypto-currency records. Someone recently used your password to try to sign into your Wallet Accoun  (CASE ID:...
2
votes
2answers
830 views

Does HTTPS protect against DNS rebinding?

I've been playing around with DNS rebinding. I made a little setup and I have it working fine with regular HTTP requests. I then tried to get it working over HTTPS and had a little "duh" moment: ...
0
votes
1answer
953 views

DnsSpoof Target machine wont connect

SETUP: Target Machine: VM on my network, on a machine that is hardwired to the router Kali Box: Tried both in a VM on the same machine as my target and a live boot on a laptop over wifi. Both ...
0
votes
3answers
832 views

File exchange over DNS Tunneling

I want to demonstrate an attacking scenario in which DNS tunneling is used to get information out of a protected network. There is the compromised host behind the firewall, at which the client is ...
1
vote
1answer
155 views

Prevent DNS leak in terminal

I understand how to fix DNS leaking in browsers. My question is, what happens when you use tools like OWASP, nikto, recon-ng or any tool for that matter that can take a URL? It's obviously going ...
0
votes
1answer
819 views

DKIM/SPF problem causing lots of DMARC reports

I get messages from "noreply-dmarc-support@google.com" with a DMARC report as follows: <?xml version="1.0" encoding="UTF-8" ?> <feedback> <report_metadata> <org_name>...
4
votes
2answers
487 views

Use SSL certificate intended for *.contoso.com on a stand alone server that is not part of contoso.com

Suppose I purchase contoso.com from GoDaddy and also purchase a wildcard SSL certificate for *.contoso.com from GoDaddy. I now have a web server on xyz.contoso.com that I can secure with HTTPS using ...
6
votes
2answers
4k views

Why does ACME / Let's Encrypt require A records not CNAME?

I'm using ngrok to demonstrate the ACME protocol on IIS/Windows. However, this service prefers CNAMEs over A records. In debugging the interaction it seems that ACME only allows for A records. What ...
4
votes
2answers
649 views

How to test CVE-2004-0789 Multiple Vendor DNS Response Flooding Denial Of Service?

I use Nessus to check vulnerabilities on my webserver. It is a Windows Server. Nessus reports that this particular server has a CVE-2004-0789 vulnerability. Here is the description from Nessus: The ...
1
vote
1answer
382 views

Passive fingerprinting of DNS client

Given a network trace that includes DNS request packets, is it possible to infer or guess which DNS client send those requests? In other words, consider a network monitoring box that can see all the ...
0
votes
1answer
49 views

Quick Question About DNS Spoofing popular/non-popular sites

Earlier I'm having a difficult time spoofing DNS to my own computer. I'm using ettercap to arp poison the target. I've had nothing but success. But I've noticed that I can only spoof non-popular ...
1
vote
2answers
1k views

Can't get dnschef to redirect my target computer to my attacking computer's setoolkit cloned site

I'm trying to create a fake DNS server by altering my router's DNS IP and redirect it to a fake facebook page using dnschef v0.2 and setoolkit 7.3. I have 2 machines. The first is the attacking ...
5
votes
1answer
6k views

Make server return “Unable to split netmask from target expression”

I'm interested in making my website a lot more secure and, while playing about scanning other websites, I found that one website responds to nmap traceroute, curl and wget console commands in such a ...
1
vote
2answers
562 views

Risks of pinging/resolving malicious sites?

If I do ping malicioussite.com or nslookup malicioussite.com, is there any risk for me? Will the people behind the malicious site know I'm looking them up? I'd like to make a program to use an IP ...
3
votes
2answers
14k views

Modify the hosts file of the router and redirect trafic

My question is how can I modify the hosts file of the router (If it exists), And redirect users to my server when they prompt a specific website?
27
votes
1answer
4k views

Why is it better to use ports 20 and 53 as source ports when portscanning?

I read that if a server is inside a DMZ behind a stateless firewall, it is a good idea to use ports 20 and 53 as source ports when conducting port scanning. Why is this a good idea? I guess the ...
3
votes
1answer
5k views

Why isn't Internet DNS based on blockchain? [closed]

Aside from the fact that verisign makes a lot of money doling out certificates from a central location.
1
vote
3answers
111 views

Can an authoritative DNS server tell who is trying to resolve a domain name?

Let's assume my domain example.com has ns1 record pointed to a random IP address 192.0.2.111. When somebody tries to resolve example.com, can the dns server at 192.0.2.111 see what IP is trying to ...
1
vote
1answer
126 views

how to debug for DNS changing Maleware on (linux/android)?

So by opening an application/browser on my Android device, I found that it pops open a set of ads. I channeled a proxy through my laptop trying to track the first web site it connects to. Later I ...
3
votes
2answers
486 views

How can I search for registered domains, but not unregistered domains?

There are many many services available to "search for domain names", but every one I have found returns results for unregistered domains; whereas I would like to a wildcard search for registered ...
2
votes
1answer
175 views

DNSSEC implementation questions (BIND 9.10)

I am planning to sign multiple DNS zones with BIND and have the following questions which I could not answer by reading the latest BIND 9.10 Reference Manual. How can I use the same ZSK with multiple ...
2
votes
2answers
83 views

Does a domain name ever leave my local system if the matching IP is defined in my hosts file?

Given the domain website.org and an a corresponding webserver with the IP 1.2.3.4. If a client defines the IP with the domain name in its host file like: $ cat /etc/hosts [...] 1.2.3.4 website....