Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

Filter by
Sorted by
Tagged with
2
votes
1answer
124 views

how to ensure that the DNS server is giving me the legitimate information?

if attacker poisioned the cache of DNS server then it will give me illegitimate information.so, how to identify it? if the solution is to create the local database of domain name and ip addresses and ...
2
votes
0answers
357 views

DNS Penetration Test and DNS Cache Poisoning

I'm learning about the Dan Kaminsky attack on a server created to test out the attack. How would I go about using dnspentest? Source code is available by clicking the link above the picture. The ...
1
vote
2answers
106 views

How much privacy do domain whois privacy services really offer?

I have a domain with my real name, address and contact info on the whois record. I am considering purchasing a privacy service to hide these details. Will that actually help, given that my record is ...
0
votes
1answer
358 views

What are known domain hijacking methods?

The definition of domain hijacking is: "to gain (temporarily) control a domain" which could be either through: Stealing the legal and/or technical ownership of a domain (for example by transferring ...
1
vote
1answer
469 views

Why is the DANE protocol depending on DNSSEC?

Why is the DNS-based Authentication of Named Entities (DANE) protocol depending on Domain Name System Security Extensions (DNSSEC)?
1
vote
1answer
279 views

How does the DANE protocol make Certificate Authorities obsolete?

How does the DNS-based Authentication of Named Entities (DANE) protocol make Certificate Authorities (CA) obsolete? In other words: How is it technically possible that DANE does not need Certificate ...
1
vote
1answer
259 views

How bad it would be? If hackers managed to take down all 13 Root DNS servers at the same time? [closed]

Would such huge DDoS attack can cause any economical damage? How severe this DDoS attack would be, if all 13 Root DNS servers got successfully DDoSed/flooded and taken out? Would any websites even ...
0
votes
0answers
333 views

DNS Server being Accessed by Internal and External Host

I came across of a situation in which I can see internal ip and external ip accessing a corporate dns server. I do not know if the dns server is internal dns or external dns. I have very limited ...
1
vote
0answers
108 views

What would an attacker need to know about the DNS request (itself) to successfully poison a DNS cache?

According to a thread I recently read, in general, for one method of DNS poisoning, an attacker only needs to know the victim's DNS server (see this thread: DNS cache poisoning). [I'm assuming the "...
1
vote
1answer
73 views

Is there any point in activating domain privacy after the fact?

If I have a domain name that does not have privacy protection enabled, is there any point in enabling it now? Or is it useless once the information is out there? I'm asking this because I'm aware that ...
2
votes
2answers
223 views

Is this DNS reflection attack a DOS or DDOS attack?

I was asked this as a test question and I was wondering if I answered correctly. I was thinking this was a DOS attack because it came from one server not multiple. So can anyone tell me if this is ...
6
votes
1answer
978 views

DNS Tunneling - Mitigation

I believe the root cause for DNS tunneling is because the internal hosts are allowed to do recursive queries of external domains. For DNS tunneling to work, an internal host should be able to send ...
2
votes
1answer
111 views

What are the security issues of having all services (web, smtp, dns) on a single machine?

I'm wondering what are the drawbacks, from a security point of view, of having more than one service (let's say the web server, the mail server and the DNS server) on the same machine, rather than ...
2
votes
0answers
229 views

Non-logging openVPN DNS queries?

I have set up OpenVPN and BIND on a VPS and have a few questions regarding DNS resolving. I have configured bind to push 10.8.0.1 to my client and set the nameserver in resolv.conf to 127.0.0.1. The ...
0
votes
2answers
204 views

Obtaining the public DNSSEC root key

Is the public DNSKEY of the DNS root zone that I have to trust when validating a DNSSEC key chain usually bundled with an OS? If so where is it located under Ubuntu 15.04, Linux? What is otherwise ...
0
votes
1answer
56 views

Information security point of view when registering a domain and chosing a TLD

How much does the choice of the domain registrar and the TLD impact the security of my information? I've learned that some registrars will require more personal information than others. I even had a ...
1
vote
3answers
578 views

Does using a different DNS server prevents DNS leaks?

Let's say I visited a website which uses HTTPS. So my ISP can't see the HTTPS traffic between us but it can see which website I'm connecting due to my DNS request. If I use a public DNS server such as ...
4
votes
1answer
1k views

Does DNS CAA policy applies to all sub domains?

I get following DNS CAA record for google.com using Google public DNS server google.com. CAA 0 issue "symantec.com" For www.google.com and mail.google.com I do not see DNS CAA record. Does above CAA ...
12
votes
3answers
603 views

Should the average user care about DNS security?

Denise is an average user who goes with the default settings of her OS and home router. She knows that her browser and email client use DNS and she's worried because I told her that the DNS protocol ...
3
votes
4answers
312 views

Preventing phishing / spear phishing of employees

We get a lot of targeted phishing emails to our employees, semi-sophisticated ones where they speak about a project or give an outline brief. We then get back to them and they send us an 'attached PDF'...
1
vote
0answers
210 views

Why isn't encrypted DNS more widely adopted? [closed]

Considering recent (and arguably successful, if slow because of their large scale) efforts to make encrypted HTTP communication ubiquitous using SSL/TLS via such CAs as Let's Encrypt, and the presence ...
0
votes
2answers
845 views

When using an SSH tunnel does the server resolve domain names or is it still done via the ISP/DNS server on the router?

With the recent UK news on the snoopers charter ISP's will be able to log and store a users Internet activities for up to a year and be made available to the Government. I've started thinking about ...
2
votes
0answers
466 views

UK ISP Snoopers Bill and DNS [closed]

The United kingdom now has one of Europe's if not the world's worst overt personal privacy laws. All Internet service providers must now as standard log every website visited with a rolling time frame ...
1
vote
0answers
46 views

Forwarding requests to known suspicious site to an isolated server

I keep getting IPS alerts for suspicious DNS requests for a known host with malware. I can't find anything from the Windows DNS logs from the domain controllers because it just shows the source ...
-1
votes
2answers
214 views

Is there a way to “manipulate” my location without third parties knowing it? (when i am logged in to my google account) [closed]

Is there a way to "manipulate" my location (IP address) without third parties knowing it? (when i am logged in to my google account)
2
votes
1answer
159 views

How does DNS / router safety checking work?

Tools such as this are used to check whether your router is infected with malware that redirects your traffic via bad guys' DNS servers. How can these tools tell which DNS servers are actually used ...
1
vote
1answer
35 views

MX records being linked to spamming?

I have seen a rule in an environment that detects DNS MX query types going from an internal source to an external, none SMTP server. The justification states that this could be indicative of malware ...
1
vote
0answers
44 views

WordPress site sends email from strange domains

I had a WordPress site with a security plugin configured to send me periodical database backups via email. This morning I noticed that I was receiving these emails as coming from two strange domains I ...
1
vote
2answers
593 views

Is reverse DNS a must have to prevent emails delivered as spam?

I was considering setting up my own mail server and one of the things I've read about is that I must setup reverse DNS to do not get caught by a spam filter. Is that really a must? Aren't SPF and ...
0
votes
1answer
160 views

How DNS blacklisting works?

Let's say we have this network setup: PC > Firewall > DNS Server I was under the impression that the PC would attempt to access the DNS server but the firewall would instantly block the request ...
0
votes
2answers
97 views

Find DNS Server of an IP over Internet [closed]

I know that many clients in the same network has a same DNS (Most of time but it can be changed.) But is there anyway to understand what DNS Server that an specific IP (Over Internet) uses through ...
5
votes
2answers
165 views

How can I (preferably metaphorically) explain DNSSEC without technical jargon?

How can I explain a non-technical person the purpose of Domain Name System Security Extensions (DNSSEC) and the risks of not using DNSSEC? It would be nice to use a metaphor, so that it's also easy to ...
-1
votes
2answers
133 views

The solution to the Dyn DNS attack is alternate servers?

The solution to the Dyn DNS attack is probably having alternate DNS services, right? If our ISP's DNS servers are hit with DDOS, can I just fire up my alternate DNS, which is either hosted by us or ...
5
votes
1answer
723 views

DNS Flood using DNS Amplification?

So, a DNS Flood is when you DDOS a DNS Server, and a DNS Amplification is when you use the DNS Server to execute a DOS attack (I think). Based on recent events (the attack to Dyn's DNS service) I was ...
6
votes
3answers
436 views

Did the October 21, 2016 DDoS attack on Dyn's DNS service cause Bandwidth Exhausion?

A recent attack on Dyn's DNS services affected several major websites last Friday, Oct 21, 2016. I would be interested to know if this was Bandwidth Exhaustion, or if it was mainly load on the server ...
8
votes
1answer
4k views

What's the difference between A and AAAA DNS records? [closed]

Dnsmasq logs show that A and AAAA records are being transmitted/received. What is the difference between to these two types of DNS records (A and AAAA)? Can either be rejected/dropped/ignored? (...
53
votes
6answers
8k views

Why don't browser DNS caches mitigate DDOS attacks on DNS providers?

Why are the recent DDoS attack against DNS provider Dyn, and other similar attacks successful? Sure a DDoS attack can bring an entity down, and if that entity controls DNS servers then queries to ...
5
votes
1answer
541 views

How to access sites whose DNS server is under attack?

As many of you noticed, last night's DDoS attack against Dyn.com made many major services unavailable, including Twitter and Spotify. Spending one Friday evening without Twitter was enough and I want ...
4
votes
2answers
222 views

Why would attacking a DNS server have the affects it did?

I'm somewhat confused as to the technical details of the Oct. 21 DDoS. Dyn is a company, which according to wikipedia is an Internet performance management company, offering products to monitor, ...
8
votes
3answers
929 views

Why was October 2016 Dyn attack limited to East Coast?

Maps on the Internet showed that the focus of the Dyn DDoS attack was on the East Coast of the US. But why? My DNS provider is not on the East Coast and I am located in Colorado. My DNS is 8.8.8.8 (...
0
votes
2answers
243 views

DNS Spoof saves IP to Domain Name after attack is finished, Is there a way to stop this?

As I understand after a Domain Name is resolved to a specefic IP through DNS www.example.com resolves to 10.10.10.10, this cache is saved in RAM in a computer for a little bit, AKA five or so minutes. ...
4
votes
3answers
1k views

MX record security

In theory, are MX records more susceptible to spammers than A records for mail servers? If a mail server only has an A record, provided the SMTP service is running, mail will still be delivered. Now I ...
0
votes
3answers
453 views

Can ICANN deny Internet service to people? [closed]

I had an argument with a co-worker yesterday about the recent transfer of the administration of ICANN. My co-worker said that, since ICANN has control over the assignment of (a) IP addresses and (b) ...
4
votes
1answer
119 views

I was the subject of a low-impact DNS attack. What do I need to do?

Recently, my website was subject to a DNS attack of sorts. I have my domain name (which I won't say here but should be pretty easy to find if you're interested) registered with Hostgator and set up ...
5
votes
1answer
1k views

Does the Tor Browser leak a list of visited websites to TLD DNS services?

Over here, it came up that the operator of a web service can find out the real IP address of a Tor Browser user by simply letting the user resolve a subdomain via a HTML element and logging who (...
2
votes
1answer
192 views

How can I prove that mail sent was NOT caused by the newly deployed DMARC policy?

I understand that by publishing an initial p=none policy, you basically instruct recipients that participate in DMARC to NOT treat incoming mail any different than how they did before a DMARC policy ...
1
vote
2answers
132 views

Can a DNS provider take action if a phishing attempt comes from one of their domains?

I received a delightful phishing attempt: Please keep this email for your crypto-currency records. Someone recently used your password to try to sign into your Wallet Accoun  (CASE ID:...
2
votes
2answers
915 views

Does HTTPS protect against DNS rebinding?

I've been playing around with DNS rebinding. I made a little setup and I have it working fine with regular HTTP requests. I then tried to get it working over HTTPS and had a little "duh" moment: ...
0
votes
1answer
1k views

DnsSpoof Target machine wont connect

SETUP: Target Machine: VM on my network, on a machine that is hardwired to the router Kali Box: Tried both in a VM on the same machine as my target and a live boot on a laptop over wifi. Both ...
0
votes
3answers
904 views

File exchange over DNS Tunneling

I want to demonstrate an attacking scenario in which DNS tunneling is used to get information out of a protected network. There is the compromised host behind the firewall, at which the client is ...