up vote -2 down vote favorite
share [g+] share [fb]

When performing some DNS brute-forcing on my company's domain, I found entries for servers like "ww" and "wwww" that point to ip's that we do not own.

What is the process for removing those unauthorized entries from DNS?

link|improve this question
2  
Why would you need to brute-force your own domain? Just look at the zone's configuration. – Shane Madden Dec 7 '11 at 18:02
The zone configuration did not show these other entries. I brute-forced my own domain to find things just like this. – schroeder Dec 7 '11 at 19:04
What do you mean by "brute-forcing", where those entries reside, what was your reason for abusing those servers by your strange scans ;) ? – Sandman4 Dec 7 '11 at 20:16
Am I missing something? Is finding these entries of zero value? – schroeder Dec 7 '11 at 20:43
@schroeder If the servers that they are on aren't authoritative for your DNS zone, the yes. These entries are of zero value. – MDMarra Dec 7 '11 at 20:54
feedback

migrated from stackoverflow.com Dec 7 '11 at 17:58

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 5 down vote

If it is on your authoritative servers that you control, then just delete the records. If it's on servers that aren't authoritative for your zone that you don't run, there's nothing that you can do except contact the server operator. That said, having records for your zone on a server that isn't authoritative for your zone isn't really a big deal.

link|improve this answer
The entries are not on our servers, of course. The concern is that typo-squatters would redirect traffic to look-a-like sites. – schroeder Dec 7 '11 at 19:05
@schroeder Unless they're authoritative for your zone, no resolver is going to query those servers. It would only be a problem for people that are DNS hijacked by malware or something and have their machines pointed directly at those servers. – MDMarra Dec 7 '11 at 19:08
@schroeder You're querying records in a domain for which your servers are authoritative, but the records aren't on your servers, correct? A few thoughts: Is a provider hosting your zone "helping" by adding these to your authoritative zone automatically? Are you querying a recurser, or an authoritative server? Is the recurser that you're querying doing NXDOMAIN hijacking (for instance, OpenDNS)? Or, in the really unlikely category, do they appear to have been cache poisoned? (no attacker would poison ww when they can just as easily take www, so this scenario is extremely unlikely). – Shane Madden Dec 7 '11 at 20:58
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.