"A" wants to resolve google.com using DNS Server 1 or 2 (as set in IPv4 settings on the NIC). But DNS Server 3 is between "A" and either DNS Server. Will server 3 attempt to respond to the DNS query? Or will the query be ignored until it reaches its intended target DNS server?

  • 1
    If A isn't configured to use DNS 3 then I don't see how DNS 3 could "intercept" the query. What do you mean that 3 is "in between"? There's no such thing as "in between". A either uses 3 or it doesn't. 1 or 2 may use 3 but that doesn't put 3 "in between" A and 1/2. – joeqwerty Mar 29 '18 at 20:03
  • 1
    Sorry, I meant that DNS Server 3 is acting as a gateway between A and the other two DNS servers, so all traffic would have to go through it anyways. – David Breeden Mar 29 '18 at 21:14
  • If you mean a gateway for traffic routing then it shouldn't have any bearing on the DNS resolution/recursion. – joeqwerty Mar 29 '18 at 21:31
  • So DNS queries are not "read" until they reach the DNS server they were sent to? I didn't know if maybe because it's UDP instead of TCP/IP that any DNS server could pick it up and respond to it. – David Breeden Mar 29 '18 at 21:44
  • 1
    @DavidBreeden see my extensive answer. As for your comment above, remember that the DNS protocol uses BOTH UDP AND TCP. And "Man in the midlle" attacks could happen even for pure TCP (hijack of IP address for example). – Patrick Mevzek Mar 29 '18 at 22:32

Each computer has a list of recursive DNS servers to contact.

When it needs to resolve a name it will contact one of these servers (typically the first one in the list, and switching to the second one only if the first one did not reply at all).

Of course, as anything traveling in the clear on the network, any element in the path could intercept either the query or the reply, and rewrite it.

It happens, and it is called "lying DNS". Some ISP for example may be tempted to rewrite NXDOMAIN replies (when the resource queried does not exist) to instead point you to a generic search engine page or things like that.

The client may or may not easily see that if it happens in the generic case. Only if the resource queried uses DNSSEC the client could verify that the answer was not modified in transit. Or, for greater security, it will need to use DNS over TLS or DNS over HTTPS, as long as it checks the remote certificate. Have a look at the software dnssec-trigger based on unbound.

  • So my case isn't really security related; we have two networks/subnets with their own DNS servers (several in each) and a one-way trust in AD between them. Some of the equipment on network 1 is configured to use the DNS servers of network 2 because they're part of the same domain (different subnets, same domain). I'm wondering if network 1's DNS servers respond to those queries. But since I saw your comment that DNS requests also use TCP I assume the answer is no since I'm guessing the TCP part is the IP address of the desired DNS server. – David Breeden Mar 29 '18 at 22:45
  • 1
    If there are no funny things on the network, the client just connects to the IP configured as recursive nameserver for him, that given server replies to its DNS queries and that is all. Either UDP or TCP depending on many things. – Patrick Mevzek Mar 29 '18 at 22:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.