Skip to content

Risorse

DNS - Uso

Interrogare il DNS

  • dig Linux man page Linux command for interacting with web servers, used in one of the Colab notebooks above.
  • Online DNS Lookup Webapp for interacting with name servers (a sort of dig on line). Specify query (name and type) and name server IP address.
  • The exact same operations of dig can be performed with nslookup, which is available in both Linux and Windows (with some differences between the two platforms). The syntax and output of nslookup is different from that of dig. Search for a tutorial if you are interested.

DNS - Architettura

  • Nameserver Basics: What is an Authoritative Server? What is a Recursive Server? Nameserver functionality can be divided into two main categories: authoritative service and recursive service....An authoritative nameserver is one that is configured to answer queries for a specified set of zones and satisfies queries from its own data without needing to reference another source. A recursive nameserver is one that answers queries by asking other nameservers for the answer. It will satisfy queries from cache if possible, but otherwise it traverses the Internet...until it finds one that provides the answer(s) that it can return to its client.
  • The Internet Domain Name System Explained for Non-Experts Una descrizione di come è realizzato il DNS (come interagiscono i name server tra loro e molto altro).
  • Root Name Servers The 13 root name servers are operated by 12 independent organisations.
    • Each IP address used for root name servers actually corresponds to many different servers, thanks to a technology called anycast that we will not study in this course (thus the number of root name servers is much greater than 13). This interaction with ChatGPT provides an overview of how anycast works.
  • Root Name Servers Traffic Count of queries made to root name servers (daily averages): They are in the order of hundreds of billions queries every day.
  • Domain Name Industry Brief - Dashboards Dati statistici sulla dimensione del DNS.
  • DNS Zone Stats On this page you can find links to graphs displaying the total domain count per TLD zone.

Importanza strategica

Can I block the DNS in an entire nation?

Robustness analysis of DNS paths and web access paths in public administration websites Computer Communications, Dec. 2021, Alberto Bartoli.

In this paper we examine the dependence of a large set of public administration websites on DNS entities for four different countries: Italy, Germany, UK and US. We collected the dependencies of those websites from DNS zones, nameservers, networks and assessed the potential global impact of localized attacks on those entities:

  • How many websites could be affected, whether in name resolution or web server access, by an attack on a single zone, nameserver, network?
  • How prevalent is the usage of groups of IP addresses, networks for providing redundancy? How many websites could be affected by an attack to one of those groups?

Name server DNS4EU

  • DNS4EU as a secure-infrastructure project provides a protective, privacy-compliant, and resilient DNS service to strengthen digital sovereignty and security for EU citizens, governments, and critical infrastructure.

Alcuni attacchi importanti

  • Global DNS Hijacking Campaign: DNS Record Manipulation at Scale ... a wave of DNS hijacking that has affected dozens of domains belonging to government, telecommunications and internet infrastructure entities across the Middle East and North Africa, Europe and North America.
  • DNS Hijacking Abuses Trust In Core Internet Service ...a new cyber threat campaign that we are calling "Sea Turtle," which is targeting public and private entities, including national security organizations, located primarily in the Middle East and North Africa. The ongoing operation likely began as early as January 2017 and has continued through the first quarter of 2019. Our investigation revealed that at least 40 different organizations across 13 different countries were compromised.
  • DNS hijacks at two cryptocurrency sites point the finger at GoDaddy, again Two cryptocurrency portals are currently dealing with DNS hijacking attacks that are redirecting visitors to fake versions of their websites where crooks are trying to collect seed phrases and private keys from visitors so they can access wallets and steal their funds.
  • Hackers breached Greece's top-level domain registrar State-sponsored hackers have breached ICS-Forth, the organization that manages Greece's top-level domain country codes of .gr and .el.
  • UK domain registry Nominet confirms breach via Ivanti zero-day Nominet, the official .UK domain registry and one of the largest country code registries, has confirmed that its network was breached two weeks ago using an Ivanti VPN zero-day vulnerability. The company manages and operates over 11 million .uk, .co.uk, and .gov .uk domain names and other top-level domains, including .cymru and .wales. It also ran the U.K.'s Protective Domain Name Service (PDNS) on behalf of the country's National Cyber Security Centre (NCSC) until September 2024, protecting over 1,200 organizations and over 7 million end users.

Creazione di domini

  • OVHcloud - domains Esempio di Registrant in cui acquistare un dominio, predisposto per "molti" TLD. E' anche un "DNS Provider" nel senso che i RR per il dominio saranno memorizzati nei suoi name server (non occorre cioè avere dei name server per gestire il dominio acquistato).

  • Internet Corporation for Assigned Names and Numbers (ICANN) is the organization that "coordinates" the DNS globally. Its website contains all the technical and procedural definitions related to how domains must be managed. A few relevant pages:

    • Registrant A domain name registrant is an individual or entity who registers a domain name.
    • Registrar ("DNS provider") An entity wishing to register a domain name under a generic top-level domain ("gTLD") may do so by using a registrar.
    • Registry operator The owner of a TLD (a TLD is a "registry").
    • Registro.it The owner of the .it domain (Consiglio Nazionale delle Ricerche, Pisa). Come diventare un Registrar (DNS provider) in grado di creare domini sotto .it.

  • Domain Name Stat Statistics by TLD, by country, by Registrar.

Identificare il proprietario di un dominio

Ci sono molti siti web gratuiti che offrono questo servizio (whois).

Nei domini di secondo livello (SLD) l'identità del proprietario (Registrant) può essere disponibile o meno, a seconda delle normative legali del paese in cui opera il DNS Provider (Registrar) e del Registrar stesso. L'Autorità Giudiziara può obbligare il Registrar a fornire l'identità del Registrant. In alcuni paesi, il Registrar può rifiutarsi di fornire l'identità del Registrant. Ovviamente, i criminali informatici che hanno necessità di acquistare domini li acquistano da Registrar "noti" per essere refrattari alle richieste dell'Autorità Giudiziaria (cosiddetti "bulletproof").

Nei domini di terzo livello il Registrant non è mai disponibile via whois. E' disponibile solo il Registrant del dominio di secondo livello corrispondente, con le limitazioni di cui sopra. Esempio: cercando bartoli.inginf.units.it su https://www.whois.com/whois/ si ottiene https://www.whois.com/whois/units.it come risposta.

Sequestri di domini