I am trying to find a way to obtain the real ip addresse(s) for a domain name. I'm working on a router doing traffic shaping with the use of iptables and tc. I then need to setup iptables rules for marking packets coming from certain domains, using their ip addresses.
In a first time I used the dig command, querying the name server of the domain, like this:
nbNameServer=`$dig NS $url +short | wc -l` # If there is NS for the given domain if [ $nbNameServer -gt 0 ]; then for i in $($dig NS $url +short $TOdig); do ipDom=`$dig @$i $url +short $TOdig` # Ip found on the $i name server, no need to consult the others if [ -n "$ipDom" ]; then failed=`echo -e "$ipDom" | egrep "no servers could be reached"` if [ ! -n "$failed" ]; then break else ipDom="" fi fi done fi
If the router in the /etc/resolv.conf file has let's say 18.104.22.168 google DNS, is there a way one of the ip or domain is not up to date or spoofed using the way I did ?
I actually don't know if the router will be in an environment where a local DNS server is used or not.
Is it possible to perform a secure DNS lookup with the host command too ?
The only thing I want to be sure is that for a given domain mydomain.com, the DNS lookup will return all the ip addresses (I just need the A or AAAA record), up to date.
I am still a little confused about all the DNS mechanisms, so any comments/remarks/advices are of course welcomed.