DNSInspect

DNS – What is it?

Wed, 16 Aug 2017 00:00:00 -0700

If you use the Internet, DNS is a term you need to be familiar with. DNS, which stands for “Domain Name System”, is a tool that translates domain names into IP addresses. This is particularly useful to verify information about a particular website or domain name.

For instance, if you want to visit a particular website, all you usually need to do is type the domain name on your browser and it will redirect you to the requested website. However, your browser does not look for the website through its domain name, but through numerical IP addresses assigned to that particular website.

People use domain names instead of IP addresses simply because they’re easier to remember. IP addresses are not only more difficult to remember, they can also change from time to time. DNS servers constantly gather this information making sure IP addresses (and other info related to a particular domain site) is accurate and up to date.

DNS can be described as being analogous to a phone book, where the domain name tells us about the identity of the site, and the associated IP tells us how to reach the site. Once you visit a particular website, your computer will cache the DNS response so that next time you visit that site it can access it faster.

However, if viruses and other malware gain entry to your Internet service provider’s DNS servers, you may be tricked into thinking you’re visiting a legitimate website while instead you’ve been redirected to a site set up by possible scammers. For example, if you type “Twitter.com” on your browser, your network’s DNS server will look for the IP associated to this site, allowing you to connect to the site. If your Internet service provider’s DNS server has been hacked by a particular virus, it will re-direct you to a different IP address while making you think that the site is legitimate.

In such instance, you could actually be connected to a fake website that looks like Twitter while seeing “Twitter.com” on your browser. Scammers usually use such tactics to trick people into revealing their user IDs and passwords for sites that look like the real thing. Usually, a good antivirus will alert you against bogus websites pretending to be legitimate. In other instances, one may want to access detailed information about a particular site. This is when a third-party DNS can become very useful.

Different DNS services can provide different information, and some are more accurate than others. Dnsinspect.com provides comprehensive and detailed DNS information involving different aspects of domain names. These include Parent servers, A records, NS records, Name servers, IPs, ASNs, SOA records, MX records, Mail servers, SPF records, and various other information. In this way, Dnsinspect.com can help reveal who is behind a particular website, as well as if the site is legitimate or fake.

Responsive Design

Wed, 18 Mar 2015 00:00:00 -0700

Last week I've found some spare time to dedicate to this lovely project. I've started the project in 2008, the first version was built with Ruby then I've migrated from Ruby to Go in 2012, this was my first project using Go language.

It was hard for me to decide which part should be improved because every time I'm looking over my code after a year or so I feel that it really needs a full refactoring. But I'm little older now and I do prefer evolution over revolution and marathons instead of sprints. :)

I've decided that it's time to give some deserved attention to mobiles and tablets. I've refactored the layout, now you can run/read reports from mobile devices without the hassle of zooming.

Other changes:

GeoIP library updated to the latest version, the IP address to country is mapping should be more accurately.

ASN check

Tue, 22 Apr 2014 00:00:00 -0700

In attempt to help better understanding of how name servers for a domain are distributed, today I've introducted an experimental test on DNSInspect. This test will display distribution of name servers among Autonomous Systems.

Name servers should be dispersed (topologically and geographically) across the Internet to avoid risk of single point of failure (RFC 2182).

What is ASN?

ASN (Autonomous System Number) is a 32 bit number used in BGP routing which uniquely identifies each network on the Internet.

This test resolves names for each name server, fetches ASN for each IPv4 address and warns users if all IP addresses are located in a single ASN.

Packet decoding bug

Fri, 17 Jun 2011 00:00:00 -0700

A few days ago Ian West pointed me an bug. In some rare cases DNSInspect.com was unable to complete running reports. I've studied the problem and I've found a bug in packet decoding layer, ldns was unable to decode received DNS data. The bug was fixed today.

I've created a credits page.

Thank you, Ian !

Report navigation

Wed, 08 Jun 2011 00:00:00 -0700

After design cleanup and a few page size optimizations made last week, today I'm introducing report navigation. This new information gives you an overview for each section (FAIL count, WARN count) which helps to read the report and includes direct links to sections for easier navigation.

Architecture update

Mon, 16 May 2011 00:00:00 -0700

Previous week I've deployed a new version of DNSInspect.com which brings a new asynchronous architecture based on EventMachine which makes DNS reports really fast (on average ~7 seconds/report). Now most of delay is produced by mail servers and its RBL checks, I still need to make some fine tunings.

While working on this release I've learned a few things:

Event-driven programming is hard, it's very easy to lock the entire process while waiting for event/condition that will never happen :)
Extending Ruby with C is fun
Starbucks may not have the best coffee, but it's a great way to escape from daily routine (warm ambiance, free WiFi and AC Power included)

Changes:

Asynchronous architecture: checks are executed in parallel which leads to faster reports
IDN (Internationalized Domain Names) support: Example reports:
- Gartenmöbel.de - ”garden furniture” in German
- 网站目录.com - Chinese
- 스타벅스코리아.com - Starbucks Korea
- аромат.com - Russian Shop
TLD DNS reports: Example TLD reports
- .com
- .travel
- .fr
- .ly
- .cz
- .ru

DomainKeys checks where removed as everyone is migrating to it's successor DKIM (no DKIM checks right now).

Database update

Mon, 09 May 2011 00:00:00 -0700

I will migrate today the website to a new asynchronous architecture which will improve report generation speed so I you may see sporadically the error page while I'm migrating the database.

Design update

Tue, 16 Nov 2010 00:00:00 -0800

Last week I've been busy working on DNSInspect.com and starting with yesterday the website has has a new face after a complete redesign. The project has a new logo, a new look and special attention was allocated to printing reports support.

I hope you enjoy the new design as I do. :) If you have any problems or suggestions regarding new design please don't hesitate to contact me.

Glue Mismatch

Wed, 03 Nov 2010 00:00:00 -0700

I've introduced today a new DNS check (Glue Mismatch) under NS section. While querying nameservers often they do provide A or AAAA records in additional section of the response to help/speed up host name resolution, those records are named glue records.

You can examine a DNS query to see glue records from command line with dig:

[vitalie@silver ~]$ dig mx redhat.com @ns1.redhat.com

; <<>> DiG 9.3.6 <<>> mx redhat.com @ns1.redhat.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2912
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 5

;; QUESTION SECTION:
;redhat.com.                    IN      MX

;; ANSWER SECTION:
redhat.com.             600     IN      MX      5 mx1.redhat.com.
redhat.com.             600     IN      MX      10 mx2.redhat.com.

;; AUTHORITY SECTION:
redhat.com.             600     IN      NS      ns2.redhat.com.
redhat.com.             600     IN      NS      ns3.redhat.com.
redhat.com.             600     IN      NS      ns1.redhat.com.

;; ADDITIONAL SECTION:
mx1.redhat.com.         600     IN      A       209.132.183.28
mx2.redhat.com.         600     IN      A       66.187.233.33
ns1.redhat.com.         600     IN      A       66.187.233.210
ns2.redhat.com.         600     IN      A       209.132.183.2
ns3.redhat.com.         600     IN      A       209.132.176.100

;; Query time: 150 msec
;; SERVER: 66.187.233.210#53(66.187.233.210)
;; WHEN: Wed Nov  3 15:05:56 2010
;; MSG SIZE  rcvd: 202

In this example while querying MX records from ns1.redhat.com I've received the IP addresses of the mail exchangers:

mx1.redhat.com.         600     IN      A       209.132.183.28
mx2.redhat.com.         600     IN      A       66.187.233.33

Sometimes you may mess up IP addresses for your nameservers (example IPs provided by your nameserves are different by IPs provided by your registrar), this new check should catch this problem.

Check your domain's glue records here:

http://www.dnsinspect.com