0

I am looking for a DNS level solution, that redirects a user to a specific IP on the first visit, than directs them to the correct IP on subsequent visits.

So the idea is, for example, if a user visits "malicioussite.com", the first time they try to resolve that DNS name, it resolves to the IP of an internal web server, showing them a warning.

On subsequent resolves, the users would get the actual IP, so they can visit the site.

How can this be achieved? I am really flexible on what I can use, as long as its on the DNS level.

Improve this question
1
  • One issue you haven't considered is that the source's IP address is likely to change, so you have no ready way, at least not at the DNS level, to identify whether it's someone's very first visit or merely their first visit with a new IP address. That alone will kill off any plan that might otherwise be implemented.
    – John Gardeniers
    Sep 3, 2012 at 7:22

3 Answers 3

Reset to default
2

This will not work this way.

Both because DNS doesn't keep track of who resolved which address and because your DNS servers are unlikely to be queried on a second visit. Instead the old answer will be remembered (cached).

Improve this answer
3
  • I believe the OP is implying that this is an internal service, which would mean he controls DNS. That, combined with a policy to disable local DNS cache, would enable him to have full control over DNS resolution and would cause multiple requests.
    – blueben
    Sep 3, 2012 at 0:25
  • If it is only for local then yes, that can work.
    – Hennes
    Sep 3, 2012 at 0:30
  • Thanks, well I'll look into using a proxy, unfortunately, I can't really do much with the DNS cache, so I'll use a proxy instead
    – Sihan Zheng
    Sep 3, 2012 at 2:01
0

This is not possible on DNS-level, because DNS doesn't keep track of who resolved which address.

Improve this answer
2
  • Is it possible for me to do something with maybe a proxy server to achieve this?
    – Sihan Zheng
    Sep 3, 2012 at 0:05
  • 1
    A proxy server might be more suitable, yes.
    – Ansgar Wiechers
    Sep 3, 2012 at 1:04
0

I don't know of any off-the-shelf DNS software that will do this, however you do have an option if you can write the logic for this yourself. PowerDNS has a pipe backend which will send requests over a pipe to a program you provide. It will provide the remote address, so you could in theory keep track of which requests you've seen before and act on that.

http://doc.powerdns.com/backends-detail.html#pipebackend-protocol

That said, if this is an internal service then it would probably be much easier to just use a transparent proxy system which allows you to capture requests and serve your own content for your warning.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .