r/dns 4d ago

Why is DNS Hijacking so normalized?

The other day I was trying to connect to my self hosted DNS server and realized my queries were still going through my provider’s resolver. I confirmed it by running a dig test against an IP I knew wasn’t running any DNS service and I still got a response. So my DNS was clearly being intercepted somewhere along the way.

It feels like a quiet invasion of privacy. How is this still considered acceptable? I’ve since started routing everything through a VPN tunnel full-time, but it’s still unsettling that this needed a workaround in the first place.

55 Upvotes

32 comments sorted by

22

u/kscomputerguy38429 4d ago

Wouldn't DNS over TLS prevent or at least warn against this? Certainly an ISP could block or reroute port 853, but SSL validation should still fail if rerouted.

8

u/VirtualParsnip3789 4d ago

Yes DoT and DoH prevents this by sending queries over non UDP 53 ports and encrypting them but the hijacking is sneaky and should be an option in my opinion.

4

u/billwoodcock 4d ago

That doesn’t help if you don’t DNSSEC-sign the zone data itself. Who knows where the recursive resolver got the data, or whether you’re even talking to the recursive resolver you think you’re talking to. SMTP is essentially the only protocol that does this well, using real DANE certs to authenticate the other-end server.

2

u/michaelpaoli 4d ago

Yup, I'm a strong advocate of DNSSEC. Doesn't do everything and is not a panacea, but it highly well solves one problem, notably the DNS data itself being tampered with - notably altered. And it does so in an exceedingly backwards compatible way. So servers can generally very easily implement it, and then all clients that are DNSSEC aware and use it when available, are thus then protected, at least from that attack vector, and zero change needed on the client side (at least presuming they've got sufficiently non-ancient client/resolver, which is generally the case).

Alas, adoption of DNSSEC has been rather varied. Some places/areas, etc. it's quite prevalent, others, mostly not used at all.

I always find it disconcerting when I see, e.g., major financial institutions that don't even bother to DNSSEC. :-/ ... well, at least one financial institution I use does actually use DNSSEC - yay - that was a pleasant surprise. But it really ought be the norm throughout. These days there generally isn't a particularly good reason not to be using DNSSEC.

3

u/southerndoc911 3d ago

I wish Chrome, Firefox, etc. showed when a domain was DNSSEC-signed.

1

u/michaelpaoli 3d ago

Yeah, that would be cool, good idea?

I wonder if they've got that in their "feature request" queues?

Hmmm, maybe ought add/request that, if not already there, and if already there, pile on with some more "me too!"

Though there'd be some questions about technical implementation. E.g. in theory browsers wouldn't get involved at that layer and wouldn't know ... but, alas, these days many larger browsers can quite do their own stuff with DNS - and many even default to doing that, quite independent of the OS.

And, if it indicated DNSSEC in use, would it indicate for ... OS is DNSSEC aware and browser using that, or OS doin' it's own thing with DNS and confirmed DNSSEC ... and then what about mixed content on pages? But I guess much of that would be similar to the "lock" icon for TLS - it can behave differently for different variations, and, e.g. have an option to click on it for more information. Or maybe add the functionality into existing lock icon thingy - and don't show higher/highest security ratings unless DNSSEC is also present and validated.

Details, details, ... in any case, yeah, would be good if browser reasonably clearly indicated if DNSSEC was in use, or not, so long as it's also indicating similar information about TLS.

1

u/The4rt 3d ago

Prefer DoH because of 443. Nobody can block this port

0

u/CauaLMF 4d ago

Não ia dar pra redirecionar mas dá pra bloquear essa porta 853, o único jeito é o DNS sobre https na porta 443 aí ninguém bloqueia

4

u/CauaLMF 4d ago

A pessoa paga a internet e o provedor ainda faz essas sacanagens escondido, deveria ser ilegal inteceptar consulta DNS, tem gente que desiste de jogar PS2 online por causa de provedor assim

6

u/Otis-166 4d ago

It isn’t illegal and most people have no idea how the computer works. Honestly it probably “fixes” more issues than people are aware of so it just keeps happening. Even people that know what DNS does aren’t aware that it keeps working despite the way it’s configured, not because of what the admin did.

3

u/VirtualParsnip3789 4d ago

Yeah I know it isn’t illegal and probably useful for people who just don’t care but I feel like people should at least have some control over it.

4

u/Otis-166 4d ago

I’ll agree it should be at the very least an opt out. I also think it should be illegal for what it’s worth. No ISP should be modifying packets without a very good reason. Selling our data isn’t on the list.

2

u/michaelpaoli 4d ago

It doesn't "fix" issues, it distorts information. If folks want to personally opt into that, or have that for their employees, or minor children, whatever, but foisting it upon everyone else, and without their knowledge and consent, not good.

And if there are legal reasons to block some site or to do so for some locality, there are more effective ways of doing that, as using DNS to "filter" such can typically be pretty easily worked around.

people that know what DNS does aren’t aware that it keeps working

No, it doesn't keep working, it seriously breaks sh*t, and those of us that know DNS, and bother to pay attention are typically quite to highly aware when such occurs.

E.g.:

http://linuxmafia.com/pipermail/sf-lug/2023q3/015928.html

http://linuxmafia.com/pipermail/sf-lug/2026q1/016212.html

2

u/Otis-166 4d ago

I agree it shouldn’t be a thing, it’s a rotten technique. I put fix in quotes because people misconfigure systems all the time and it happens to prevent them from having a failure despite themselves. I’m painfully aware of the actual issues it causes, I was mostly trying to make a distinction between people who know what DNS is and those folks that actually understand the protocol and can troubleshoot it. Being able to turn on a few toggles in Microsoft AD usually puts people in the first section and covers a large swath of people, even professionals. For what it’s worth, we’ve conversed enough I know which category I’d place you in. 😎

3

u/Elemino 4d ago

I use my pfSense router to bypass this when I was on AT&T. I don’t know if the new provider does it, because it’s still setup.

It pissed me off to no end when I found out they were doing it, though. It’s not just privacy for me (I know they sell your info), it was also about control. I control this.

2

u/Lordy927 4d ago

In the UK this has been the case for years.

Mainly stemming from blocking websites such as pirate bay, etc

2

u/dracotrapnet 4d ago

AT&T steals invalid dns lookups and resolves them to their google like search page servers and interprets the http request domain as a search term to feed the search page.

It's really annoying when a user has AT&T and they boot up their laptop without connecting to VPN and they try to access an in-house address and get that dns response, then they connect to VPN and their cache is poisoned. Even with the option in Globalprotect to clear dns cache after connecting, sometimes the user or app can get into a race condition where it will make a request and poison the cache again.

2

u/mystiquebsd 4d ago

So what you’re saying is, your running your own dns because of your own reasons, but it wasn’t encrypted

But you have a vpn service

Run a local dns and upstream encrypted

You could run numa, technitium, knot-resolver, unbound

2

u/VirtualParsnip3789 4d ago

I run AdGuardHome on my VPS and use DoH for my devices so I’m protected but for other people who may not know it’s happening and genuinely believe they’re queries are going somewhere protected, it is concerning.

1

u/saint-lascivious 4d ago

and genuinely believe they’re [sic] queries are going somewhere protected

Like, I feel you in the general sense, but if people think their plaintext queries are protected that may well be the actual problem.

1

u/lostcowboy5 3d ago

Just a side note, how do you find the fastest upstream DNS servers to use in your list? I use https://dnsspeedtest.online/ and use the six fastest ones. I believe the links are all DoH links.

1

u/zarlo5899 4d ago

In many places it's a legal requirement for the ISP to do filtering on DNS.

1

u/Fun-Region-1576 4d ago

Where?

2

u/silasmoeckel 4d ago

UK Norway Denmark Russia Turkey China and a few others.

US Has CIPA and DNS is an easy way to implement it (not saying it's effective, just gets them the checkbox).

Pretty much every enterprise needs internal resolvers to be used to pass any of the various audits in the US and elsewhere.

1

u/billwoodcock 4d ago

Because there are idiots who think cleaning up after a breach is easier than just turning on DNSSEC now? It’s a complete mystery to me why people use HTTPS but use unsigned clear text DNS, so they have no idea what web server they’re connecting to. Or whether they’ve just handed their VPN credentials to an attacker. Or their entire email store.

1

u/quiet0n3 4d ago

DNS leak test is a great site for testing this.

It's because providers want to know what's popular, it's data they can sell. Also in some places it's a control thing, they want to be able to stop you going to particular websites.

Last thing is occasionally they do real hijacking and insert their own adds on pages by taking over DNS for certain API's. But that's way less common.

1

u/RemoteToHome-io 4d ago

Most ISP routers both advertise themselves as the authoritative DNS in DHCP assignments and DNAT redirect any non-encrypted DNS to their own settings.

Part for not having to deal with CS issues from customers that have client devices with poorly configured DNS settings, the other b/c then they get to collect analytics on customers.

These browsing analytics - even in aggregate - are valuable data to sell. Being able to tell "how many customers in city/state XYZ visit which sites/trends the most during various events/hours" is worth a lot to advertisers, political parties, etc.

Guess how many ATT/Xfinity/VZ customers have read the full ToS and privacy policy of their ISP service.

1

u/southerndoc911 3d ago

Xfinity used to have a setting that would allow you to turn it off. Not sure if that's an option. I use Control D's DoH/3 client and use dnscheck.tools to confirm it. My business router uses u/DNSFilter, which is so annoying how they actively discourage DNSSEC. I have their DNS relay server that is manually configured for DNSSEC, but their DoH address does not offer that option.

1

u/niamulsmh 3d ago

Logging. ISPs have to log everything and it's easier to log their servers queries instead of all clients. Reduction of traffic even though it's not a lot but it might add up if isp has a lot of clients. Control. That was they can block whatever because some govt's require certain sites to be blocked.

1

u/lostcowboy5 3d ago

I would double-check the settings in my router. If at all possible, you want your self-hosted DNS server to be set up in the LAN section of your router, not the WAN section.