<html><head></head><body> <div dir="auto"><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; ;Times New Roman", serif; ;">Thank you kindly for the reply Michel.</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; ;Times New Roman", serif; ;"><br style=";"></div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; ;Times New Roman", serif; ;">I've tried something like it before with no luck, however the command line arguments you offered at least moved me a step forward, as it confirms the setup.</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; ;Times New Roman", serif; ;">However, the offending subdomains still resolve, example:</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; ;Times New Roman", serif; ;"><br style=";"></div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;"># dnsdist -c</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">> tostring(evilDomains:check(newDNSName("<span dir="ltr" style=";">1e100.net</span>")))</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">true</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">> quit</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;"># nslookup</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">> server 192.168.1.2</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">Default server: 192.168.1.2</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">Address: 192.168.1.2#53</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">><span class="Apple-converted-space"> </span><span dir="ltr" style=";">mad07s25-in-f3.1e100.net</span></div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">Server: 192.168.1.2</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">Address: 192.168.1.2#53</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; min-height: 13px; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;"><br style=";"></div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">Non-authoritative answer:</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">Name:<span class="Apple-converted-space"> </span><span dir="ltr" style=";">mad07s25-in-f3.1e100.net</span></div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">Address: 142.250.201.67</div><div style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">Name:<span class="Apple-converted-space"> </span><span dir="ltr" style=";">mad07s25-in-f3.1e100.net</span></div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">Address: 2a00:1450:4003:811::3</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;"><br style=";"></div><div id="appendonsend" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; ; ;"></div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; ;Times New Roman", serif; ;">And the lines in /etc/dnsdist/dnsdist.conf are:</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; ;Times New Roman", serif; ;"><br style=";"></div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">evilDomains = newSuffixMatchNode()</div><div style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">evilDomains:add("<span dir="ltr" style=";">1e100.net</span>")</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">addAction(SuffixMatchNodeRule(evilDomains), SpoofAction("0.0.0.0"))<br style=";"><br style=";">I tried with PoolAction but it also didn't work.</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">Restarted the server and even rebooted for an update.</div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;"><br style=";"></div><div class="elementToProof" style="; font-style: normal; ; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; ; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; ; ; line-height: normal; margin: 0px; ;Times New Roman", serif; ;">Any ideas?</div><br></div><div dir="auto"><br></div> <div><br></div><div><br></div>On Wed, Jul 24, 2024 at 08:48, Michel Otte <<a class="" href="mailto:On Wed, Jul 24, 2024 at 08:48, Michel Otte <<a href=">michel@cybox.nl</a>> wrote:<blockquote type="cite" class="protonmail_quote"> <div dir="ltr"><div dir="ltr"><div>Hello André,</div><div><br></div><div>Blocking a complete suffix in dnsdist can be done with a SuffixMatchNode [1]. You can then use a SuffixMatchNodeRule [2] in a rule. For example:</div><div><br></div><div>evilDomains = newSuffixMatchNode()</div><div>evilDomains:add("<a href="http://evildomain.com">evildomain.com</a>")</div><div>addAction(SuffixMatchNodeRule(evilDomains), PoolAction("abuse"))</div><div><br></div><div>Now any requests that query a QNAME that ends in "<a href="http://evildomain.com">evildomain.com</a>" will be sent to the "abuse" pool, or any other action [3] you want.</div><div><br></div><div>And if you connect to the CLI via a client connection (dnsdist -c), you can still manage the SuffixMatchNode, for example:</div><div><br></div><div>evilDomains:remove("<a href="http://evildomain.com">evildomain.com</a>")</div><div>evilDomains:add("<a href="http://otherdomain.com">otherdomain.com</a>")</div><div>tostring(evilDomains:check(newDNSName("<a href="http://evildomain.com">evildomain.com</a>")))</div><div></div><div><br></div><div><div><div class="gmail_signature" dir="ltr"><div dir="ltr"><font style="font-size:12.8px" color="#000000"><span style="font-size:12.8px">With kind regards,</span><br style="font-size:12.8px"><span style="font-size:12.8px">Michel Otte</span></font><br style="font-size:12.8px;color:rgb(136,136,136)"></div><div dir="ltr"><br></div><div dir="ltr">[1]: <a href="https://dnsdist.org/reference/config.html#suffixmatchnode">https://dnsdist.org/reference/config.html#suffixmatchnode</a></div></div></div>[2]: <a href="https://dnsdist.org/reference/selectors.html#SuffixMatchNodeRule">https://dnsdist.org/reference/selectors.html#SuffixMatchNodeRule</a></div><div>[3]: <a href="https://dnsdist.org/reference/actions.html">https://dnsdist.org/reference/actions.html</a></div></div><br><div class="gmail_quote"><div class="gmail_attr" dir="ltr"><br></div><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><div> <div dir="auto">Hello everyone,</div><div dir="auto"><br></div><div dir="auto">A tactic to thwart DNS sinkholes is not to have an A record in the domain name and then offer hundreds or more subdomains that can be reached via UDP, and if firewall blocked, via TCP. At least, it’s what I’m facing.</div><div dir="auto"><br></div><div dir="auto">It’s laborious work to identify each subdomain, add firewall rules, host entries etc to then discover its resilience on trying different variations on subdomains hinting at a wildcard setup where any is valid.</div><div dir="auto"><br></div><div dir="auto">I wanted to enquire about the possibility of a wildcard sinkhole to spoof the main domain and all of the subdomains to tackle such scenarios as I’ve didn’t get it to work</div><div dir="auto"><br></div><div dir="auto">Best regards </div><div dir="auto">André Ferreira</div></div>_______________________________________________<br>
dnsdist mailing list<br>
<a target="_blank" href="mailto:dnsdist@mailman.powerdns.com">dnsdist@mailman.powerdns.com</a><br>
<a target="_blank" rel="noreferrer" href="https://mailman.powerdns.com/mailman/listinfo/dnsdist">https://mailman.powerdns.com/mailman/listinfo/dnsdist</a><br>
</blockquote></div></div>
</blockquote></body></html>