Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If I do a reverse DNS lookup on my domain's public IP address, I see an unknown domain in the list of websites that use this IP address. This unknown domain does not belong to me but to a jeefang cheng in Fuzhou City China, who also owns 960 other domains.

I know it's not illegal, but WHAT EXACTLY can jeefang chen gain from this?

  • boosting the ranking of the other domain?
  • some kind of impersonation that depends on reverse DNS
  • spamming by spoofing my e-mail addresses?
  • stealing passwords that are used ot access my domain?

I can't quite see how any of these might work... All ideas and clarification welcome

share|improve this question
4  
Do you use shared hosting? In this case, it might be as simple as the other person also hosting a domain on the same server. –  SvW Oct 31 '11 at 18:38

3 Answers 3

Multiple domains can exist on a single IP address. You are most likely using a shared server to host your domain. So is the other guy. You are both on the same server.

share|improve this answer
    
His domain is hosted on another server in a completey different IP space. My domain is hosted on my server with my IP address. –  carol chisholm Nov 1 '11 at 6:57

You should direct your question to the owner of that IP address. They decide what it resolves to.

share|improve this answer

To ease your concerns a little.

  • boosting the ranking of the other domain? Shouldn't work as rankings are based on the URL used to access the content. Web sites frequently don't have PTR records, and when they do often they don't pass rDNS validation.
  • some kind of impersonation that depends on reverse DNS? This would require that they be able to establish connections using your IP address. This would require corrupting some network routing tables. Adding their domain to the PTR record would not be useful if they want to impersonate your server.
  • spamming by spoofing my e-mail addresses? This would be more easily accomplished if your domain had an extra A records pointing to someone else's IP address. They could then setup the appropriate PTR records for rNDS validation to work. Appropriate SPF records help prevent spoofing your domain?
  • stealing passwords that are used ot access my domain? I haven't seen any password schemes which rely on PTR records. A or CNAME records could be used to redirect traffic to someone else's servers where passwords could be captured.

As other have noted, if your server exists in a shared services environment, then you may be sharing the IP address. Otherwise, your IP address provider may not have cleaned up their PTR database. The domain may have previously been hosted on your IP address.

Verify the results from the authoritative DNS servers for the IP address. Some resolver configurations may result in reverse look values being returned from /etc/hosts or other local databases.

There are four requirements for a PTR record to be reliable for reverse DNS spoofing:

  • The connection must originate from the PTR record's address. This is reasonably easy to spoof for UDP connections, but more difficult for TCP connections.
  • The IP address must have one or more PTR records returning a valid domains. This appears to be the case.
  • The valid domain must have an A (or IPv6 AAAA) record for the originating IP address.
  • There must be a functioning DNS server returning PTR data for the originating IP address. (Many IP addresses do not have a publicly accessible server.)

Reverse DNS is useful for providing some measure of trust in the identity of a connecting server. It is most commonly used to validate incoming SMTP connections. This is highly reliable for personal email. However, automated mail sending services are often poorly configured.

share|improve this answer
    
Thanks. My domain has been at the same (not shared) IP address for years. I will just have to assume mr or mrs jeefang has no malicious intent... –  carol chisholm Nov 1 '11 at 6:59
    
Contact your IP provider (likely your ISP) and get them to remove the pointer record anyway. –  BillThor Nov 1 '11 at 13:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.