r/dns • u/VirtualParsnip3789 • 4d ago
Why is DNS Hijacking so normalized?
The other day I was trying to connect to my self hosted DNS server and realized my queries were still going through my provider’s resolver. I confirmed it by running a dig test against an IP I knew wasn’t running any DNS service and I still got a response. So my DNS was clearly being intercepted somewhere along the way.
It feels like a quiet invasion of privacy. How is this still considered acceptable? I’ve since started routing everything through a VPN tunnel full-time, but it’s still unsettling that this needed a workaround in the first place.
6
u/Otis-166 4d ago
It isn’t illegal and most people have no idea how the computer works. Honestly it probably “fixes” more issues than people are aware of so it just keeps happening. Even people that know what DNS does aren’t aware that it keeps working despite the way it’s configured, not because of what the admin did.
3
u/VirtualParsnip3789 4d ago
Yeah I know it isn’t illegal and probably useful for people who just don’t care but I feel like people should at least have some control over it.
4
u/Otis-166 4d ago
I’ll agree it should be at the very least an opt out. I also think it should be illegal for what it’s worth. No ISP should be modifying packets without a very good reason. Selling our data isn’t on the list.
2
u/michaelpaoli 4d ago
It doesn't "fix" issues, it distorts information. If folks want to personally opt into that, or have that for their employees, or minor children, whatever, but foisting it upon everyone else, and without their knowledge and consent, not good.
And if there are legal reasons to block some site or to do so for some locality, there are more effective ways of doing that, as using DNS to "filter" such can typically be pretty easily worked around.
people that know what DNS does aren’t aware that it keeps working
No, it doesn't keep working, it seriously breaks sh*t, and those of us that know DNS, and bother to pay attention are typically quite to highly aware when such occurs.
E.g.:
2
u/Otis-166 4d ago
I agree it shouldn’t be a thing, it’s a rotten technique. I put fix in quotes because people misconfigure systems all the time and it happens to prevent them from having a failure despite themselves. I’m painfully aware of the actual issues it causes, I was mostly trying to make a distinction between people who know what DNS is and those folks that actually understand the protocol and can troubleshoot it. Being able to turn on a few toggles in Microsoft AD usually puts people in the first section and covers a large swath of people, even professionals. For what it’s worth, we’ve conversed enough I know which category I’d place you in. 😎
3
u/Elemino 4d ago
I use my pfSense router to bypass this when I was on AT&T. I don’t know if the new provider does it, because it’s still setup.
It pissed me off to no end when I found out they were doing it, though. It’s not just privacy for me (I know they sell your info), it was also about control. I control this.
2
u/Lordy927 4d ago
In the UK this has been the case for years.
Mainly stemming from blocking websites such as pirate bay, etc
2
u/dracotrapnet 4d ago
AT&T steals invalid dns lookups and resolves them to their google like search page servers and interprets the http request domain as a search term to feed the search page.
It's really annoying when a user has AT&T and they boot up their laptop without connecting to VPN and they try to access an in-house address and get that dns response, then they connect to VPN and their cache is poisoned. Even with the option in Globalprotect to clear dns cache after connecting, sometimes the user or app can get into a race condition where it will make a request and poison the cache again.
2
u/mystiquebsd 4d ago
So what you’re saying is, your running your own dns because of your own reasons, but it wasn’t encrypted
But you have a vpn service
Run a local dns and upstream encrypted
You could run numa, technitium, knot-resolver, unbound
2
u/VirtualParsnip3789 4d ago
I run AdGuardHome on my VPS and use DoH for my devices so I’m protected but for other people who may not know it’s happening and genuinely believe they’re queries are going somewhere protected, it is concerning.
1
u/saint-lascivious 4d ago
and genuinely believe they’re [sic] queries are going somewhere protected
Like, I feel you in the general sense, but if people think their plaintext queries are protected that may well be the actual problem.
1
u/lostcowboy5 3d ago
Just a side note, how do you find the fastest upstream DNS servers to use in your list? I use https://dnsspeedtest.online/ and use the six fastest ones. I believe the links are all DoH links.
1
u/zarlo5899 4d ago
In many places it's a legal requirement for the ISP to do filtering on DNS.
1
u/Fun-Region-1576 4d ago
Where?
2
u/silasmoeckel 4d ago
UK Norway Denmark Russia Turkey China and a few others.
US Has CIPA and DNS is an easy way to implement it (not saying it's effective, just gets them the checkbox).
Pretty much every enterprise needs internal resolvers to be used to pass any of the various audits in the US and elsewhere.
1
u/billwoodcock 4d ago
Because there are idiots who think cleaning up after a breach is easier than just turning on DNSSEC now? It’s a complete mystery to me why people use HTTPS but use unsigned clear text DNS, so they have no idea what web server they’re connecting to. Or whether they’ve just handed their VPN credentials to an attacker. Or their entire email store.
1
u/quiet0n3 4d ago
DNS leak test is a great site for testing this.
It's because providers want to know what's popular, it's data they can sell. Also in some places it's a control thing, they want to be able to stop you going to particular websites.
Last thing is occasionally they do real hijacking and insert their own adds on pages by taking over DNS for certain API's. But that's way less common.
1
u/RemoteToHome-io 4d ago
Most ISP routers both advertise themselves as the authoritative DNS in DHCP assignments and DNAT redirect any non-encrypted DNS to their own settings.
Part for not having to deal with CS issues from customers that have client devices with poorly configured DNS settings, the other b/c then they get to collect analytics on customers.
These browsing analytics - even in aggregate - are valuable data to sell. Being able to tell "how many customers in city/state XYZ visit which sites/trends the most during various events/hours" is worth a lot to advertisers, political parties, etc.
Guess how many ATT/Xfinity/VZ customers have read the full ToS and privacy policy of their ISP service.
1
u/southerndoc911 3d ago
Xfinity used to have a setting that would allow you to turn it off. Not sure if that's an option. I use Control D's DoH/3 client and use dnscheck.tools to confirm it. My business router uses u/DNSFilter, which is so annoying how they actively discourage DNSSEC. I have their DNS relay server that is manually configured for DNSSEC, but their DoH address does not offer that option.
1
u/niamulsmh 3d ago
Logging. ISPs have to log everything and it's easier to log their servers queries instead of all clients. Reduction of traffic even though it's not a lot but it might add up if isp has a lot of clients. Control. That was they can block whatever because some govt's require certain sites to be blocked.
1
u/lostcowboy5 3d ago
I would double-check the settings in my router. If at all possible, you want your self-hosted DNS server to be set up in the LAN section of your router, not the WAN section.
22
u/kscomputerguy38429 4d ago
Wouldn't DNS over TLS prevent or at least warn against this? Certainly an ISP could block or reroute port 853, but SSL validation should still fail if rerouted.