Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

Filter by
Sorted by
Tagged with
1
vote
1answer
61 views

Is the _acme-challenge subdomain protected?

I was looking into the DNS-01 challenge of Let's Encrypt, and I had a question about the subdomain process [1]. Let's say, the website example.com gives away free subdomains; what stops me to request ...
2
votes
1answer
91 views

Transfer requests for localhost zone on my bind DNS server

I use Debian stretch and Bind 9.10.3 as my DNS server. Today I saw the following entry in my log file: Apr 17 23:04:22 ns named[111]: client 45.83.65.112#48974 (localhost): transfer of 'localhost/IN'...
2
votes
1answer
58 views

DNS cache snooping protection

Is it possible to protect against DNS cache snooping on ISC bind and PowerDNS servers? If not, is there a similar DNS server software which can't protect agains snooping?
0
votes
0answers
20 views

Does installing and routing OpenVPN DNS queries through a local resolver make any difference to the IP address seen by the eventual DNS server?

This is related to my previous question - When pushing a DNS resolver to an OpenVPN client, does the resolver see the IP address of the client or the OpenVPn server?. If an OpenVPN server ...
3
votes
3answers
8k views

What is same site scripting and what are some exploit scenarios?

I know it is an issue with how DNS is configured , but is it really dangerous if the attacker couldn't access your network?
0
votes
1answer
36 views

When pushing a DNS resolver to an OpenVPN client, does the resolver see the IP address of the client or the OpenVPn server?

When configuring an OpenVPN server, you have the option of pushing DNS resolvers to the client - like so: push "dhcp-option DNS " If this approach is used and a public DNS resolver is defined, will ...
28
votes
3answers
7k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
17
votes
4answers
8k views

DNSSec (Comcast) vs DNSCurve (OpenDNS)

I was previously using OpenDNS on my internal network. I found out today that Comcast has switched over to DNSSec: Comcast DNSSec. I've done a little research on DNSSec and its benefits. I ...
134
votes
2answers
24k views

Why is “fhepfcelehfcepfffacacacacacacabn” a top DNS query from my devices?

I recently set up NextDNS on my personal devices to further reduce the amount of tracking and ads I'm exposed to. The service comes with built-in analytics that shows a brief overview of your network ...
17
votes
4answers
19k views

Is it safe to have a DNS record pointing to 127.0.0.1?

My development server is on my local machine (127.0.0.1). I have created an A record in my DNS settings that points dev.mydomain.com to 127.0.0.1 so that I can use this domain name for accessing my ...
1
vote
4answers
247 views

Are different top level domains somehow different security wise?

If so why is the difference? I've tried to google it but nothing relevant was found.
1
vote
1answer
129 views

Can a DNS query source be spoofed?

Will the DNS server reply to the spoofed address if you send a DNS request on behalf of it? What I'm trying to ask isn't DNS spoofing but spoofing the source address.
0
votes
0answers
16 views

Do I have to be careful about DNS I'm using? [duplicate]

There's some website which I can't have access to and they return 403 error to me. On the other hand, there are some DNS servers, where if I use them, I can have access to those websites! Does using ...
0
votes
1answer
125 views

Can I intercept DNS-over-HTTPS (DoH) or -TLS (DoT) in my home network?

Right now I am redirecting all local network DNS traffic to my Pi-hole install, since some device do or may in the future use hardcoded DNS servers to bypass filtering. Since DNS-over-HTTPS and DNS-...
0
votes
0answers
35 views

Updating Ubuntu [duplicate]

How can I make sure in the terminal that my Ubuntu updates are from the real source? I am asking because I know that one download was fake. It was rkhunter. The update was malware. Done from Bangkok....
0
votes
0answers
62 views

Can you use a domain to forward web traffic at DNS to another domain but still use the MX record for this domain

What I am attempting to do is ensure all ingress web traffic [http(s)] to exampledomain1.com forwards to exampledomain2.com but I still want to use the MX record of exampledomain1.com to point to at ...
0
votes
2answers
54 views

What difference to privacy will I get if i change my workplace wifi DNS to static ones on my iPad? [duplicate]

I access internet at my workplace with an iPad that has workplace profile installed on it. This allows me to automatically connect to the company wifi, along with their own DNS settings. If I change ...
1
vote
2answers
234 views

Disabling external DNS lookups - is this really so beneficial for security?

I have recently started working for a company which disables external DNS resolution from the machines inside the network by not adding external forwarders to the internal DNS servers - the reasoning ...
1
vote
2answers
120 views

Why did browsers choose to implement HSTS with Preload over checking custom DNS information?

Browsers and standards bodies favor HSTS with Preload because it avoids ever sending an http request to a website that supports https. This is good, because cleartext http requests can be intercepted ...
0
votes
1answer
104 views

DNS communicating with a remote host on an unusual server port 53

We have an Active Directory EC2 server on AWS US East region that has DNS enabled to resolve only internal hostnames. It is not reachable from any hosts on the public internet. Recently we enabled an ...
1
vote
2answers
188 views

Fortigate Creating Millions of DNS events to standard domains [closed]

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
1
vote
1answer
62 views

Basic Auth exposed to ISP/DNS?

Would someone using basic authentication in a URL such as https://username:password@example.com have their credentials be visible to their ISP or DNS?
0
votes
1answer
446 views

Verify Quad9 is working

Disclaimer: I am a complete neophyte. I set 9.9.9.9, Quad9, as my DNS in my router's configuration. How do I verify Quad9 is working and that I am benefiting from its features, especially encrypted ...
0
votes
1answer
77 views

Should a DNS server restrict reverse lookups from external hosts?

What risks are there in allowing external clients to resolve internal IPs to their domain names? The server is used internally for clients, as well as for external clients needing to resolve a web ...
1
vote
1answer
639 views

How does proxychains avoid DNS leaks?

Also directly related, how are the DNS servers queried when using proxychains? Assume I'm using Tor for proxychains. If I uncomment the DNS part of proxychains.conf, my requests supposedly get sent ...
12
votes
2answers
4k views

How does DigitalOcean DNS verify the owner of a domain?

Say you purchase a domain on Namecheap, but want to host DNS on DigitalOcean. DigitalOcean, says to simply tell your registrar to use DO's nameservers, then set up your DNS for that domain on DO. ...
1
vote
1answer
68 views

Can I test ssl connection locally with a valid certificate (CA) with local dns?

I have a wildcard valid certificate signed by Certificate Authority. Is it possible to test the https locally from the server without a registered DNS? My idea is to bind the domain name with 127.0....
0
votes
1answer
113 views

Does Kerberos authentication handle DNS names the same way between Windows 7 and Windows 10?

Recently, we migrated from Windows 7 to Windows 10 and during that migration, we progressively ran into some issues with our NAS device. To be more precise, we progressively noticed some tcp socket ...
0
votes
1answer
267 views

DNS Tunnel or Not (g01.msn.com)

Thought I found DNS tunneling and but after a closer look it seems a bit more complex. Anyone seen this traffic before? User starts their computer, launches firefox.exe, then they hit c.msn.com ...
1
vote
1answer
86 views

No MX Records on a Possible Phishing domain?

I saw on my SMTP logs that it queried a possible phishing domain, I look up on its MX records and it didn't have one. Does the domain need an MX record before sending phishing emails?
0
votes
0answers
28 views

Are there any risks selling subdomains? [duplicate]

I am considering buying a nice domain name (say example.com) and would be interested in reselling subdomains (e.g. chris.example.com) to third parties (or close friends). I would give them full ...
6
votes
2answers
4k views

Can you force your PC or device to use only DNSSec-verified lookup results?

Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.) Well, I certainly ...
0
votes
1answer
63 views

Is there something like DynDNS for a DNS service?

I run a small DNS server (pihole) at home behind a firewall, with some custom filtering. It mainly filters ads and trackers, plus some top level domains I want to avoid navigating to. I have an IPv4 ...
1
vote
0answers
368 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
3
votes
2answers
122 views

Weird DNS queries to messager.xicp.net

A DNS query for this domain (messager.xicp.net) was classified and detected as "Trojan.Generic.DNS" by the FireEye NX in our network. So, I used both VirusTotal and abuseibdb sites to check this ...
0
votes
1answer
98 views

How to protect users from malware utilizing protocols such as DNS over HTTPS?

With the increased drive to enable DNS over HTTPS (DoH), it's likely that non-browser applications and systems may utilize DoH services other than those promoted by Mozilla and Google. Since malware ...
7
votes
2answers
8k views

DNS Spoofing vs ARP spoofing, the relationship?

As I understand, ARP spoofing can only be done on the LAN-side of the router? DNS spoofing, can that be done either side of the router? In order to do DNS spoofing, do you need to perform ARP ...
2
votes
2answers
602 views

Does Chrome respect the X-DNS-Prefetch-Control header?

If my web page returns X-DNS-Prefetch-Control=off, will Chrome do DNS prefetch for links like these?: <link rel="dns-prefetch" href="http://www.spreadfirefox.com/"> I know Firefox and Chromium ...
2
votes
1answer
62 views

Certificate warning when I enable DNSSEC

I registered mydomain.net (with Google domain registration server). In the DNS settings on the google control panel, I say that mail.mydomain.net should go to the email cloud app (business.zoho.com in ...
3
votes
1answer
1k views

Level 3 DNS default response for invalid host names

I was recently flummoxed by an issue related to me setting my router's static DNS servers to what I understand to be Level 3 DNS servers, (4.2.2.1, 4.2.2.2, etc.). For work I use a company VPN. On ...
1
vote
1answer
170 views

Another domain pointed to my server, what are the risks?

I recently had another domain point to one of my servers. After adding some nginx configuration I was able to mitigate this. My server now throws a 404 in this scenario. My question is what are the ...
2
votes
1answer
282 views

Can an ISP redirecting DNS traffic be detected by the end user?

If an ISP wants to gather profiles on users, or block certain websites, they can fairly easily redirect outgoing UDP traffic to port 53 to their own DNS servers. How could this be detected by the end ...
0
votes
0answers
71 views

Can DNS-over-HTTPS be broken by reverse DNS lookups? [duplicate]

If anyone can see the receiver IP address in a HTTPS request, what will stop ISPs from analysing the packet, reverse DNS lookup the IP and block the access to the domain the client is trying to reach. ...
5
votes
2answers
188 views

With DNSSEC, is there any benefit in DANE for a CA- issued Cert?

I just deployed DNSSEC at val-id.com and getvalid.com Since DNSSEC is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by publishing my CA-...
0
votes
1answer
103 views

Why would my firewall show that my computer connects to DNS servers other than the ones I have defined?

I'm looking at my firewall logs and even though I have my computer set to a static DNS, the logs are showing that my computer is reaching out to multiple DNS servers via port 53. I am worried about ...
0
votes
0answers
37 views

How does Smart DNS intercept traffic and what are the implications?

In reading about Smart DNS, my understanding is that a device such as a router is configured with the DNS server IP addresses of the Smart DNS provider as opposed to one that is issued by the ISP or ...
0
votes
1answer
80 views

Universal DNS Resolver [closed]

I would like to implement a DNS client which should be able to resolve any valid domain public, private or otherwise (tor,i2p). What's the best way to achieve this? I know that I need to pick a ...
4
votes
1answer
2k views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
0
votes
0answers
46 views

Trace the orgins of a DNS request [duplicate]

I installed a DNS server on a Raspberry PI to monitor DNS requests. One request that is curious is "fscta65w.com." It keeps showing up in the querlog from a macbookPro but I can't seem to find out the ...
0
votes
0answers
66 views

DNS Spoof Printer on network

I was wondering if it would be possible to arp spoof my printer and router arpspoof -t printer router arpspoof -t router printer and then reroute all print requests to my CUPS print server on ...

1
2
3 4 5
14