no-dns network matches random names [solved]

jesnow · l33t Joined: 26 Apr 2006 Posts: 892

This is a strange behavior:

I run a small network at home and the router takes care of forwarding dns requests. Between hosts I use entries in /etc/hosts and fixed ip addresses, so i don't have to run bind. I don't want to run bind. BUT if a make a typo in a host name, my router seems to send the request to some random server:

mike155 · Posted: Wed Nov 18, 2020 1:08 am Post subject:

Interesting!

I get

Hu · Administrator Joined: 06 Mar 2007 Posts: 23066

There is a known defect with some ISPs that they mishandle DNS requests for non-existent domains. Instead of returning NXDOMAIN as they should, they return an A record pointing to some server they control, in the hope that the request came from a web browser that they can mislead into connecting to that server. The resulting server is usually infested with ads and may, if you are lucky, attempt to guess what you meant and suggest that to you - all in Javascript-laden HTML, of course. This behavior breaks a variety of conforming clients, among them web browsers and mail transport agents, which expect that requesting resolution of a non-existent domain will result in an answer that the domain does not exist. Such ISPs consider this misbehavior a "feature" or a "service to their users" and adamantly insist that they are doing a good thing and that you should just live with their DNS resolver being broken.

jesnow · l33t Joined: 26 Apr 2006 Posts: 892

That looks correct:

https://hackercodex.com/guide/how-to-stop-isp-dns-server-hijacking/

I'm going to have to think about how to fix that.

Wow.

JS.

Hu · Administrator Joined: 06 Mar 2007 Posts: 23066

If the broken ISP nameserver is returning consistent addresses for the override, you might be able to configure your local resolver to rewrite responses with that A record to report NXDOMAIN to your client. Failing that, you could add an unreachable route to the bad addresses, so that traffic is stopped locally before getting to them. (This is not as good as NXDOMAIN, as clients will still wrongly think the host exists.)

AlexJGreen · Tux's lil' helper Joined: 19 Sep 2018 Posts: 149

jesnow · l33t Joined: 26 Apr 2006 Posts: 892

Hu · Administrator Joined: 06 Mar 2007 Posts: 23066

That suggests the ISP does not intercept / redirect DNS traffic, but does mishandle requests that you send directly to them. In some rare cases, you can opt out of this DNS mangling, after which your ISP will handle DNS queries correctly. How to do this is very ISP-specific though.

jesnow · l33t Joined: 26 Apr 2006 Posts: 892

I have to go look for the "Route my dns typos intended for the local net to random outside servers" check box and clear it!

Hu · Administrator Joined: 06 Mar 2007 Posts: 23066

One option, which may or may not be available, would be to direct your local resolver not to delegate unqualified hostnames up to the ISP. This wouldn't help when you incorrectly request nosuchdomain.org, but it would stop nosuchhost from resolving.

jesnow · l33t Joined: 26 Apr 2006 Posts: 892

Solution: It's actually very simple: Don't use your router as a nameserver. Use for example 4.4.4.4 or 8.8.8.8, they don't do that.

in /etc/resolv.conf:

Tony0945 · Posted: Mon Dec 14, 2020 1:58 pm Post subject:

Better yet net-dns/dnsmasq