9

I have several machines on my LAN. Most of them Ubuntu based. Router has DD-WRT (v3.0-r33675M kongac Release: 11/03/17) firmware.

I have set DHCP to serve network settings for all my computers. Router has been set to use 9.9.9.9 for DNS server.

Now I want to verify my computers are using quad9 for DNS, but I am unable to do so. My computers see only the router and are not aware which DNS it is using.

For example, command (in Ubuntu)

sudo netstat -l --inet -n -v -p | grep :53 | grep -i udp

Gives

udp        0      0 127.0.1.1:53            0.0.0.0:*  

So I cannot verify I am using quad9 in this manner.

Router does not recognize this command, so I cannot verify DNS setting that way.

I have tried things in this post in computer and in DD-WRT command line, but none help: What DNS servers am I using?

How can I properly verify I am using quad9 for DNS?

7

You can use tcpdump to see where the DNS traffic goes:

# tcpdump -i eth0 -n udp port 53 or tcp port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
16:09:02.961122 IP 192.168.115.15.49623 > 192.168.115.5.53: 6115+ A? www.heise.de. (30)
16:09:02.983664 IP 192.168.115.5.53 > 192.168.115.15.49623: 6115 1/13/14 A 193.99.144.85 (493)
| improve this answer | |
3

I'm not getting a direct method to check which DNS address your router is using. So, I'm suggesting alternate method using dig.

Try digging different domains like

dig facebook.com
dig msn.com
dig google.com

DNS use extensive caching. So after first time a domain is quarried your router will catch the result and deliver it without asking 9.9.9.9. But if the router is quarried with new domain each time it must ask 9.9.9.9

So,chose at least 10 different domains. And from the reply of dig you can find the responding DNS server. If it's 9.9.9.9 then your router must be using that.

After the Answer Section of the response from dig you shall see like this

;; Query time: 522 msec
;; SERVER: 9.9.9.9#53(9.9.9.9)
;; WHEN: Sat Nov 25 20:12:59 IST 2017
;; MSG SIZE  rcvd: 54

NOTE Don't try very unknown domain. In that case the answer must be fetched from the authoritative nameserver. Or some server between quad9 and authoritative may response. So, use familiar domains which are expected to be pre-cached by 9.9.9.9. And don't rely the result from a single domain. Try with multiple domains.

| improve this answer | |
  • On DD-WRT: root@DD-WRT:~# dig google.com -sh: dig: not found – Ohto Nordberg Nov 25 '17 at 14:55
  • On Ubuntu: dig google.com ; <<>> DiG 9.10.3-P4-Ubuntu <<>> google.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63261 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;google.com. IN A ;; ANSWER SECTION: google.com. 252 IN A 216.58.195.78 ;; Query time: 48 msec ;; SERVER: 127.0.1.1#53(127.0.1.1) ;; WHEN: Sat Nov 25 16:52:30 EET 2017 ;; MSG SIZE rcvd: 55 – Ohto Nordberg Nov 25 '17 at 14:56
  • SERVER: 127.0.1.1#53. So google.com is already fetched by loacl machine. And stop if any DNS caching server running in your system like dnsmasq – Abhik Bose Nov 25 '17 at 14:59
1

We a dns leak server (do a search, there are some on the web) on the internet to check. If you ISP is DNS proxying then nslookup may give the wrong answer.

| improve this answer | |
  • Using dnsleaktest.com I get 74.63.25.243, which is not 9.9.9.9. – Ohto Nordberg Nov 25 '17 at 14:22
  • A who is look up of that, shows it to be woodynet ipinfo.io/AS42/74.63.25.0/24 Is that the owner of the DNS server? If not then it is not set up correctly, or there is a leak. – ctrl-alt-delor Nov 25 '17 at 14:35
  • That is exactly why I am doing this. So far this remains a mystery. – Ohto Nordberg Nov 25 '17 at 14:57
  • @OhtoNordberg That's probably because 9.9.9.9 is an anycast address. – kasperd Nov 25 '17 at 16:13
  • WoodyNet seems to be part of quad9, so all is fine – Ohto Nordberg Nov 25 '17 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.