Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My university department has a local DNS server that serves all of the computers in the department. I am concerned about the privacy and security implications of this. Posit that I am merely one of the users on a workstation, with no privileged access to the DNS server, or any HTTP proxy.

  • Can I make use of the DNS server to determine whether someone else in the department has accessed a page on some arbitrary external WWW site? Can I do so for accesses within the last few seconds?
  • If the answer to the preceding question is "Yes." what tradeoffs do I have to make in order to close this leak? If adjustments need to be made to the DNS server, what form would they take? Could I address this purely from the individual workstation end, without touching the server?
  • Would installing more than one DNS server affect this? If so, how? How about running DNS servers on the workstations?
  • Is this actually a leak? Would I be able to determine the same information without using the DNS server? Would I be able to determine better information, indeed?
share|improve this question

closed as not a real question by MDMarra, Shane Madden, Evan Anderson, mailq, Smudge Jan 25 '12 at 21:42

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Do you control the DNS server (or, alternatively, other aspects of the network)? – Shane Madden Jan 25 '12 at 21:30
no i am just a regular user and not a system admin – kuchiku Jan 25 '12 at 21:35
Please read the FAQ before posting questions, "Server Fault is for system administrators and desktop support professionals". We're not here to help you get around things people like us have put in place to protect you. – Smudge Jan 25 '12 at 21:44
FYI, for you professionals here, it's worth knowing that a conformant recursive server when asked a question with the RD bit clear should only answer from cache and not go look up the domain again. This does allow untrusted users to interrogate the cache without (in theory) altering the contents of that cache. – Alnitak Jan 26 '12 at 0:02
up vote 0 down vote accepted

Run nslookup (where is the domain name). If it comes back saying "non-authoritative" then the entry was cached; if not then it must have contacted an authoritative server.

This isn't a surefire way of knowing, since the server might be set to never cache. You'd have to look at the logs on the server to know with any degree of certainty (assuming logs exist).

share|improve this answer

You can't be 100% sure. Whilst unlikely, it's quite possible that somebody accessed that web site without touching your DNS servers. They might have used public DNS servers, or possibly accessed the site via it's IP address.

If all your HTTP(S) traffic is routed via a proxy server, you best bet might be to access the logs of the proxy server.

Edit: Just spotted your comment, in which case, the correct answer is to speak to your systems administrator, but he should deny your request for this information if he's doing his job properly.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.