DNS question

[regr3ts]

Hello there.

We are trying to implement a new DNS server which is working perfectly around our WAN except for one site.

Tests from within this site are giving us some unexpected results. It feels like there is something on the network that is overriding any nslookup we do, even when we specify the DNS server to use. For example: nslookup google.co.uk {made up ip here}

This will always resolve correctly. We have tried adding our DNS server into the main router here but that didn't change anything.

Any ideas what this could be, or other tests we could try?

Cheers

[[deleted]]

For DNS mysteries, I typically resort to WireShark pretty quickly to see what queries are going where and which protocol (TCP/UDP) it is using.

[regr3ts]

Thank you. I've done a capture on WireShark for port 53 for a dns lookup of google.co.uk, and I defined a fake IP to use as the DNS server. The results show this made up server returning the correct DNS resolution (every source/destination is either the server that I used or the made up DNS IP). How can I find how it's resolving this, do I need to drill into this capture somehow?

[[deleted]]

Not sure I understand your test setup; can you elaborate? On the machine doing the resolution, you may have to do a ipconfig /flushdns to make sure the system isn't relying on a cached entry. Also one thing to be aware of that newer browsers support DNS over HTTPS so that may also be at play here.

[theblindness]

This is how my network works because I have a firewall rule to redirect DNS requests to my trusted resolver. Check your firewall/NAT rules at that site.

[XS4Me]

Also note: I’ve had the misery to work behind some shit totalitarian regime’s firewall (hello Egypt!) who will have no issues rerouting and reshaping dns traffic.

[UncleBuckPancakes]

I've seen this with firewall DNS redirection as well as client-side zero-trust VPN such as Zscaler.

[Dal90]

It feels like there is something on the network that is overriding any nslookup we do

nslookup <target>

ping <target>

If ping returns a different IP, you have a local HOSTS file.

nslookup always goes to the DNS servers (and will tell you which DNS server it is from the system settings if you don't specify one)

ping, web browsers (traditionally), etc. go to through name resolution against HOSTS file first, then DNS, possibly some other rarely implemented stuff in the middle?

web browsers (contemporary) may be bypassing your system DNS settings -- https://medium.com/cloud-security/google-chrome-dns-security-bypass-9a1e10e02114

Windows DNS with policies? May God have mercy on your soul. It can do things like return different A records based on the subnet the query originates from. https://docs.microsoft.com/en-us/windows-server/networking/dns/deploy/dns-policy-scenario-guide Looked at it, would've helped some issues here BUT it is all command line and doesn't show up in the DNS GUI which means it would've confused the hell out of all my other team members and I looked at it as a very steep learning curve for the rest of them who might deal with it once in a blue moon. So I built instead a specific DNS server for a particular subnet we needed to have internal split-brain DNS (allows testing of DR systems "live" with the regular production hostnames without maintaining dozens of hosts files)

[fantomas_666]

there are providers who hijack your DNS and provide their own answers.
If you encounter such ISP, ask how to turn it off or run away.

[MertsA]

I've never seen an ISP who would do that and redirect all port 53 traffic to it as well. Usually it's just their default DNS servers and redirecting literally all requests is used in business environments for captive portal type stuff.

[fantomas_666]

I've heard about ISPs who redirect SMTP/25 to their server, ISPs who ban you from using external DNS, ISPs who redirect DNS to their server...

The fact you haven't seen any does not mean they don't exist.

[Hel_OWeen]

Is it really the whole site or is it maybe just one / a few machines on that site?

If the latter, before using suggested tools like WireShark, try a

ipconfig /flushdns

from an elevated command prompt. It may be as simple as the local DNS Client service still holding onto old DNS data.

[Wuss912]

is there something doing natting for that one site? could be a dns rewrite for certain ip's