TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Ask HN: What if your DNS provider is a honeypot?

6 pointsby niksmacalmost 5 years ago
I started using nextdns.io recently and pretty happy with it until I got this thought of what if they are a honeypot? How can we validate it, for any DNS provider?

4 comments

LinuxBenderalmost 5 years ago
If you mean they give a different answer specifically for you, then you would have to mirror your requests to multiple providers and the root servers to see who is not telling the truth. Perhaps build a web UI like this [1] or write a script to select some of your commonly requested names and query all the servers. At times you can expect answers to differ, as people change DNS and TTL will expire from caches at different times. Some sites may give a different IP based on the source location of your DNS client if they are doing GSLB and not using Anycast.<p>In a script you might use the &quot;dig&quot; command with options like this so you can see when the TTL is about to expire.<p><pre><code> dig @some_server +noall +answer some.domain </code></pre> [1] - <a href="https:&#x2F;&#x2F;www.whatsmydns.net&#x2F;#NS&#x2F;ycombinator.com" rel="nofollow">https:&#x2F;&#x2F;www.whatsmydns.net&#x2F;#NS&#x2F;ycombinator.com</a>
评论 #23434317 未加载
diablo1almost 5 years ago
Sending all your requests to a single DNS point is bad security. Best just &#x27;spreading&#x27; your DNS out, so use a mix of Quad9, Google, OpenDNS, Cloudflare 1.1.1.1 etc<p>I live by the motto: Don&#x27;t put all your eggs in one basket
评论 #23428783 未加载
viraptoralmost 5 years ago
What do you mean by a honeypot? Do you mean if they&#x27;re running a scam, or actually a honeypot and you&#x27;re running a scam that could be found?
评论 #23428788 未加载
elliottinventalmost 5 years ago
I think you have to trust your DNS resolver or choose a new one. You can compare the results of different resolvers but I&#x27;m not aware of any solutions out of the box. For example:<p>dig example.com A<p>compare against<p>dig example.com A @dns.google.com<p>etc