I am looking for a DNS level solution, that redirects a user to a specific IP on the first visit, than directs them to the correct IP on subsequent visits.

So the idea is, for example, if a user visits "malicioussite.com", the first time they try to resolve that DNS name, it resolves to the IP of an internal web server, showing them a warning.

On subsequent resolves, the users would get the actual IP, so they can visit the site.

How can this be achieved? I am really flexible on what I can use, as long as its on the DNS level.

  • One issue you haven't considered is that the source's IP address is likely to change, so you have no ready way, at least not at the DNS level, to identify whether it's someone's very first visit or merely their first visit with a new IP address. That alone will kill off any plan that might otherwise be implemented. – John Gardeniers Sep 3 '12 at 7:22

This will not work this way.

Both because DNS doesn't keep track of who resolved which address and because your DNS servers are unlikely to be queried on a second visit. Instead the old answer will be remembered (cached).

  • I believe the OP is implying that this is an internal service, which would mean he controls DNS. That, combined with a policy to disable local DNS cache, would enable him to have full control over DNS resolution and would cause multiple requests. – blueben Sep 3 '12 at 0:25
  • If it is only for local then yes, that can work. – Hennes Sep 3 '12 at 0:30
  • Thanks, well I'll look into using a proxy, unfortunately, I can't really do much with the DNS cache, so I'll use a proxy instead – Sihan Zheng Sep 3 '12 at 2:01

This is not possible on DNS-level, because DNS doesn't keep track of who resolved which address.

  • Is it possible for me to do something with maybe a proxy server to achieve this? – Sihan Zheng Sep 3 '12 at 0:05
  • 1
    A proxy server might be more suitable, yes. – Ansgar Wiechers Sep 3 '12 at 1:04

I don't know of any off-the-shelf DNS software that will do this, however you do have an option if you can write the logic for this yourself. PowerDNS has a pipe backend which will send requests over a pipe to a program you provide. It will provide the remote address, so you could in theory keep track of which requests you've seen before and act on that.


That said, if this is an internal service then it would probably be much easier to just use a transparent proxy system which allows you to capture requests and serve your own content for your warning.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.