Friday, 8 April 2011

Reverse DNS lookup using nslookup

It's easy to get the IP address from a domain name, just ping it.

C:\Users\Administrator>ping s15243155.onlinehome-server.info

Pinging s15243155.onlinehome-server.info [212.227.102.68] with 32 bytes of data

Or use nsLookup to get the A record, which does the same

C:\Users\Administrator>nslookup -q=a s15243155.onlinehome-server.info
Server: my.router
Address: 192.168.1.1

Non-authoritative answer:
Name: s15243155.onlinehome-server.info
Address: 212.227.102.68

To reverse the lookup, then you use the special "in-arpa.arpa" domain with the IP address backwards... like this

C:\Users\Administrator>nslookup -q=ptr 68.102.227.212.in-addr.arpa
Server: my.router
Address: 192.168.1.1

Non-authoritative answer:
68.102.227.212.in-addr.arpa name = s15243155.onlinehome-server.info

102.227.212.in-addr.arpa nameserver = nsa2.schlund.de
102.227.212.in-addr.arpa nameserver = nsa.schlund.de
nsa.schlund.de internet address = 195.20.224.98
nsa2.schlund.de internet address = 195.20.244.5

This really comes into play when fixing this error in ZoneCheck:

w: Reverse for the nameserver IP address doesn't match
  • ns1.xyz.net/86.xx.xx.194
To Fix this, click Start>Run>dnsmgmt.msc

Select Reverse Lookup zones, select the .in-addr.arpa.

Right Click, Select "New Pointer (PTR)", enter the first 3 digits of the IP into the "Host IP Address" and enter the nameserver domain into "Host name", then press OK




Thursday, 24 February 2011

xn--j6w193g The new Hong Kong IDN (香港)

The HKDNR is releasing the new Chinese IDN top level domain for Hong Kong (香港) on the 10 March, 2011.

The punycode version of this domain is xn--j6w193g with the following DNS infrastructure:

xn--j6w193g nameserver = NS2.CUHK.EDU.HK
xn--j6w193g nameserver = NS1.HKIRC.NET.HK
xn--j6w193g nameserver = ADNS1.BERKELEY.EDU
xn--j6w193g nameserver = HK-NS.PCH.NET
xn--j6w193g nameserver = SEC3.APNIC.NET
xn--j6w193g nameserver = NS3.CUHK.EDU.HK
xn--j6w193g nameserver = ADNS2.BERKELEY.EDU
xn--j6w193g nameserver = NS2.HKIRC.NET.HK
xn--j6w193g nameserver = B.DNS.TW

B.DNS.TW internet address = 210.201.138.58
B.DNS.TW AAAA IPv6 address = 2404:0:10a0::58
NS2.CUHK.EDU.HK internet address = 137.189.6.21
NS2.CUHK.EDU.HK AAAA IPv6 address = 2405:3000:3:60::21
NS3.CUHK.EDU.HK internet address = 202.45.188.39
SEC3.APNIC.NET internet address = 202.12.28.140
SEC3.APNIC.NET AAAA IPv6 address = 2001:dc0:1:0:4777::140
ADNS1.BERKELEY.EDU internet address = 128.32.136.3
ADNS2.BERKELEY.EDU internet address = 128.32.136.14
ADNS2.BERKELEY.EDU AAAA IPv6 address = 2607:f140:ffff:fffe::e
HK-NS.PCH.NET internet address = 204.61.216.46
HK-NS.PCH.NET AAAA IPv6 address = 2001:500:14:6046:ad::1

Friday, 18 February 2011

DNS EventID 5502

Ever seen EventID 5502 in the windows DNS event log, here is some investigation into them:

The DNS server received a bad TCP-based DNS message from 78.251.84.232. The packet was rejected or ignored. The event data contains the DNS packet.

0000: 49 54 4f 4e 20 53 69 73 ITON Sis
0008: 3a 70 6d 6e 20 53 49 50 :pmn SIP
0010: 2f 32 2e 30 0d 0a 56 69 /2.0..Vi
0018: 61 3a 20 53 49 50 2f 32 a: SIP/2
0020: 2e 30 2f 54 43 50 20 6e .0/TCP n
0028: 6d 3b 62 72 61 6e 63 68 m;branch
0030: 3d 66 6f 6f 0d 0a 46 72 =foo..Fr
0038: 6f 6d 3a 20 3c 73 69 70 om:
0048: 74 61 67 3d 72 6f 6f 74 tag=root
0050: 0d 0a 54 6f 3a 20 3c 73 ..To: ..C
0068: 6c 2d 49 44 3a 20 35 30 l-ID: 50
0070: 30 30 30 0d 0a 43 53 65 000..CSe
0078: 71 3a 20 34 32 20 4f 50 q: 42 OP

Which, read as a block is:
ITON Sis:pmn SIP/2.0..Via: SIP/2.0/TCP n m;branch=foo..From: ;tag=root..To: ..Call-ID: 50000..CSeq: 42 OP

As far as I can make out that SIP is a VOIP system (Voice over IP), where someone has attempted to connect via VOIP to the DNS port of the nameserver.

Another request was;

0000: 20 54 2f 6e 63 69 25 65 T/nci%e
0008: 30 32 6f 70 72 74 73 25 02oprts%
0010: 32 43 2f 54 72 69 25 36 2C/Tri%6
0018: 45 69 74 79 2e 74 78 74 Eity.txt
0020: 25 32 65 62 61 6b 20 48 %2ebak H
0028: 54 54 50 2f 31 2e 30 0d TTP/1.0.
0030: 0a 0d 0a 00 00 00 00 00 ........

Which reads as €rts%2C/Tri%6Eity.txt%2ebak - €rts,/Trinity.txt.bak

As a quote from "http://www.uusikaupunki.fi/~bgt/blog/bgt_mindscape_0805.php"

GET /nice%20ports%2C/Tri%6Eity.txt%2ebak HTTP/1.0

[...] Trinity.txt.bak, which is a file name chosen as one that the software developers are sure enough that can't be found on server and does provide with a 404 error message. Apparently this string in the logs suggests a probe by a piece of software calles Nmap ...

Ironically enough, the character "Trinity" from the Matrix uses NMap to hack into
a powerstation "http://www.youtube.com/watch?v=0TJuipCrjZQ", and possibly my DNS server also! :)

Thursday, 16 December 2010

Adding a DNS TXT record on a Windows DNS server


Google now offers DNS TXT records as a form of site verification, this can be done via a Windows DNS server as follows:

1. Open dnsmgmt.msc
2. Select your domain
3. Right click, select new domain
4. Enter the name & select the folder icon
5. Right click Other new records
6. Select TXT - you'll see:

Text (TXT) record. Holds a string of characters that serves as descriptive text to be associated with a specific DNS domain name. The semantics of the actual descriptive text used as data with this record type depends on the DNS domain where these records are located. (RFC 1035)

7. Press Create Record.
8. Leave the top box blank and copy the value listed in "Other" in Google's verficiation

Monday, 13 December 2010

Google uses DNS to verify domain ownership

In Google webmaster tools, you can now verify your domain using a DNS TXT record,

" You can use this option if you can sign in to your domain registrar or hosting provider and add a new DNS record."

It provides the following tips for how to set up a DNS TXT record with major domain registrars:

'eNom.com':'


  1. Log in to your account for reflector.webtropy.com at www.enomcentral.com.

  2. Select My Domains from the Domains drop-down menu in the top navigation bar.

  3. Select Host Records from the Manage Domain drop-down in the middle of the page.

  4. On the Edit Host Records page, if there's not already a blank row, click the + new row button to add a new host record row.

  5. In the new row, leave the Host Name field blank.

  6. Select TXT from the Record Type drop-down menu.

  7. In the Address field, copy and paste the following unique security token:


    google-site-verification=SZbLFW5cn6o-N_9k0bzkc4UAhMQEotpvjt52pJtsTEI


  8. Click the save button.

  9. When you've done saving the TXT record, click the Verify button below on this page.


enom.com screenshot


Congratulations! Your new DNS TXT record now contains your security token. Keep in mind that changes to your DNS settings can take up to 24 hours to propagate through the Internet, but depending on your host, this can happen faster.



If you have trouble adding your TXT record, contact your domain host directly for further assistance. If you're not sure what to say, here's a sample explanation that you can email to your host or read over the phone.



','GoDaddy.com':'

  1. Log in to your account for reflector.webtropy.com at www.godaddy.com by clicking the My Account tab.

  2. Under the Domains header, click (Advanced Details) to the right of reflector.webtropy.com.

  3. Under the DNS Manager header, click Launch.

  4. In the TXT (Text) section, click Quick Add.

  5. In the Host field, enter @.

  6. In the TXT Value field, copy and paste the following unique security token:


    google-site-verification=SZbLFW5cn6o-N_9k0bzkc4UAhMQEotpvjt52pJtsTEI


  7. Leave the TTL drop-down as the default selection.
  8. At the top or the bottom of the page, click the Save Zone File button.
  9. Click OK in the pop-up.



GoDaddy.com Screenshot


Congratulations! Your new DNS TXT record now contains your security token. Keep in mind that changes to your DNS settings can take up to 24 hours to propagate through the Internet, but depending on your host, this can happen faster.



If you have trouble adding your TXT record, contact your domain host directly for further assistance. If you're not sure what to say, here's a sample explanation that you can email to your host or read over the phone.


','MelbourneIT.com.au':'

MelbourneIT doesn't support the TXT method of verification. Please select another verification method from the above list.




','Name.com':'


  1. Log in to your account for reflector.webtropy.com at www.name.com.

  2. Click the Account icon in the top navigation bar.

  3. Click the domain you're using.

  4. At the right of the page, under Control Panel, click Domain Management to expand the menu.

  5. Click DNS Record Management.

  6. On the DNS Management page, select TXT from the Add a Record drop-down.

  7. Your cursor will automatically move to the Record Host field (to the left of your domain name). Leave this field blank.

  8. In the Record Answer field (to the right of your domain name), copy and paste the following unique security token:



    google-site-verification=SZbLFW5cn6o-N_9k0bzkc4UAhMQEotpvjt52pJtsTEI


  9. Leave the TTL field set to the default.

  10. Click submit.

  11. When you've done saving the TXT record, click the Verify button below on this page.




Name.com Screenshot


Congratulations! Your new DNS TXT record now contains your security token. Keep in mind that changes to your DNS settings can take up to 24 hours to propagate through the Internet, but depending on your host, this can happen faster.




If you have trouble adding your TXT record, contact your domain host directly for further assistance. If you're not sure what to say, here's a sample explanation that you can email to your host or read over the phone.



','NetworkSolutions.com':'


  1. Log in to your account for reflector.webtropy.com at www.networksolutions.com by clicking the Manage Account icon.

  2. In the left navigation bar, open the nsWebAddress (Domains) menu by clicking the + icon.

  3. Click Manage Domain Names.

  4. On the Domain Details page for the domain you're using, select the Designated DNS radio button (to the right of Change domain to point to) and click the Apply Changes button.

    If you've previously modified your advanced DNS settings, click Edit (to the right of Domain currently points to).

  5. Under the Advanced DNS Manager heading, click Manage Advanced DNS Records.

  6. Under the Text (TXT Records) heading, click Add/Edit.

  7. In the Host field, enter @.

  8. Leave the TTL field set to the default value.

  9. In the Text field, copy and paste the following unique security token:


    google-site-verification=SZbLFW5cn6o-N_9k0bzkc4UAhMQEotpvjt52pJtsTEI


  10. Click Continue.

  11. Review your changes and click Save Changes.

  12. When you've done saving the TXT record, click the Verify button below on this page.


Network Solutions Screenshot


Congratulations! Your new DNS TXT record now contains your security token. Keep in mind that changes to your DNS settings can take up to 24 hours to propagate through the Internet, but depending on your host, this can happen faster.



If you have trouble adding your TXT record, contact your domain host directly for further assistance. If you're not sure what to say, here's a sample explanation that you can email to your host or read over the phone.



','Register.com':'


  1. Log in to your account for reflector.webtropy.com at www.register.com.

  2. Under the blue My Accounts tab, click the domain that you're using.

  3. Scroll down to the Advanced Technical Settings heading and click Edit TXT Records (SPF).

  4. Leave the Host Name field blank.

  5. In the TXT Record field, copy and paste the following unique security token:

    google-site-verification=SZbLFW5cn6o-N_9k0bzkc4UAhMQEotpvjt52pJtsTEI


  6. Click Continue.

  7. Review your changes and click Continue.

  8. When you've done saving the TXT record, click the Verify button below on this page.


Register.com Screenshot


Congratulations! Your new DNS TXT record now contains your security token. Keep in mind that changes to your DNS settings can take up to 24 hours to propagate through the Internet, but depending on your host, this can happen faster.



If you have trouble adding your TXT record, contact your domain host directly for further assistance. If you're not sure what to say, here's a sample explanation that you can email to your host or read over the phone.



','Yahoo.com':'

At this time, Yahoo DNS hosting doesn't support TXT records. If you bought your domain through Yahoo, please use the HTML file method of verification above.



','1and1.com':'

1and1.com doesn't support the TXT method of verification. Please select another verification method from the above list.




'};

Sunday, 12 December 2010

Restarting Bind

This gave me a heart attack today (not literally)

root@vps /etc/init.d # rndc stop
root@vps /etc/init.d # rndc start
rndc: connect failed: 127.0.0.1#953: connection refused

But after a few seconds, it appears to be just a case of saying "named" and it starts again.

Monday, 6 December 2010

Amazon DNS service

Dear Amazon Web Services Customer,

We're excited to introduce today a highly available and scalable Domain Name System (DNS) service - Amazon Route 53. It is designed to give developers and businesses a reliable and cost effective way to route end users to Internet applications by translating human readable names like www.example.com into the numeric IP addresses like 192.0.2.1 that computers use to connect to each other. Route 53 effectively connects user requests to infrastructure running in Amazon Web Services (AWS) -- such as an Amazon Elastic Compute Cloud (Amazon EC2) instance, an Amazon Elastic Load Balancer, or an Amazon Simple Storage Service (Amazon S3) bucket -- and can also be used to route users to infrastructure outside of AWS.

A reliable, cloud-based DNS service has been one of the most requested offerings by our customers. With Route 53, you can create a "hosted zone" to add DNS records for a new domain or transfer DNS records for a domain you currently own. Route 53 is also designed to work well with other AWS offerings, such as AWS Identity and Access Management (IAM). By using AWS IAM with Route 53, you can control who in your organization can make changes to your DNS records. In the future, we plan to add additional integration features such as the ability to automatically tie your Amazon Elastic Load Balancer instances to a DNS name, and the ability to route your customers to the closest EC2 region.

Route 53 is also designed to be fast and simple. It uses a global network of DNS servers to respond to end users with low latency and has an easy-to-use, self-service API. There are no long-term contracts or minimum usage commitments for using Route 53 - you pay $1.00 per month for the hosted zones you manage, $0.50 per million queries for the first billion queries, and $0.25 per million queries above a billion.