Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to find a way to obtain the real ip addresse(s) for a domain name. I'm working on a router doing traffic shaping with the use of iptables and tc. I then need to setup iptables rules for marking packets coming from certain domains, using their ip addresses.

In a first time I used the dig command, querying the name server of the domain, like this:

nbNameServer=`$dig NS $url +short | wc -l`

# If there is NS for the given domain
if [ $nbNameServer -gt 0 ]; then

for i in $($dig NS $url +short $TOdig); do

    ipDom=`$dig @$i $url +short $TOdig`

    # Ip found on the $i name server, no need to consult the others
    if [ -n "$ipDom" ]; then
        failed=`echo -e "$ipDom" | egrep "no servers could be reached"`

         if [ ! -n "$failed" ]; then

If the router in the /etc/resolv.conf file has let's say google DNS, is there a way one of the ip or domain is not up to date or spoofed using the way I did ?

I actually don't know if the router will be in an environment where a local DNS server is used or not.

Is it possible to perform a secure DNS lookup with the host command too ?

The only thing I want to be sure is that for a given domain, the DNS lookup will return all the ip addresses (I just need the A or AAAA record), up to date.

I am still a little confused about all the DNS mechanisms, so any comments/remarks/advices are of course welcomed.

share|improve this question
up vote 5 down vote accepted

Practically speaking, it's highly unlikely that the results you obtain from dig will have been falsified. If you want some sort of absolute assurance, though, you're out of luck -- without something like DNSSEC, spoofing is entirely possible.

share|improve this answer
Ok, so as long as I query the domain for its eventual name server and then do the ip lookup for the domain specifying the name server, it's the best I can do to ensure the authenticity of the ip addresses ? – Mulot Jan 1 '10 at 5:47
I wouldn't even bother with that. If some requests are going to be spoofed, you can't guarantee that any of them are correct. Just use dig as per normal and move on with more interesting things. – womble Jan 1 '10 at 6:31

As long as DNSSEC isn't widely used, the best way to protect against DNS spoofing is to use "source port randomization". This is especially important since the "Kaminsky DNS bug".

You need to make sure that both the version of DIG that you use as well as the recursive DNS server that you query have implemented "source port randomization".

Theoretically it is still possible to spoof even "source port randomization", but it would take a LONG time and a LOT of network traffic.

share|improve this answer

So, if you do a dig +dnssec and look for 'ad' in the flags field, you know it wasn't spoofed... but since dnssec is not enabled for very many zones, that isn't going to tell you anything in most cases.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.