8

I am newbie in network security. I cannot understand how can a server detect my DNS servers and how they can be useful to break anonymity.

I understand how does the Internet work. How the request is made to a web site. OSI model & TCP/IP stack etc.

  1. When I type google.com, my browser send the request to a DNS server that is set for my network interface or router. In my case the DNS server is provided by my ISP.
  2. A DNS server returns the IP address of a website.
  3. My browser makes request to the webserver by the IP address instead of the name .

But how can a server know my DNS servers and how they can help them to break my anonymity ?

For example services like https://www.dnsleaktest.com and https://whoer.net

I would be grateful for any explanation, information, articles, etc. about this topic.

solderingiron
  • 83
  • 4

1 Answers1

10

I think you are a bit confused about what DNS leakage is and isn't. The problem with DNS leakage isn't that the website knows what DNS server you are using. The issue is that the DNS server knows what websites you are visiting.

For example, let's suppose you are using TOR, but not routing your DNS traffic through TOR. (This is a classic example of DNS leakage.) Then, you go and visit www.google.com. When you do that, you are correct that your browser sends a DNS lookup request to your DNS server for www.google.com. However, if you are not routing DNS through TOR, then the DNS server can see both your IP address, and the website that you are visiting. You are anonymous to Google, but not to your DNS server.

Therefore, the problem with DNS leakage is that the DNS server can see who you are and what websites you are visiting. This can be prevented, however, simply by configuring your VPN, proxy, TOR, or whatever else you are using to route DNS traffic through the anonymization tunnel along with HTTP and HTTPS traffic.

B00TK1D
  • 301
  • 2
  • 12
  • Thank you so much for the great answer. I have already set static DNS servers on my router DD-Wrt. Could you please explain how can services mentioned in the question can detect my DNS, this is just javascript API that can query DNS servers or something else ? – solderingiron May 01 '17 at 17:09
  • 1
    When using Tor it is not Tor which decides how DNS lookups are performed. Rather it is the client which connects to Tor which can request a connection to either a hotsname or an IP address. Often the client is a browser configured to use Tor as SOCKS proxy, the browser can either do DNS lookups (and leak names) or simply pass the names to Tor and let Tor do the lookups without leaking names. – kasperd May 01 '17 at 17:47
  • 1
    @kasperd - Exactly. If the client is not configured to pass DNS lookups through TOR, then DNS leakage will take place. If the client does pass DNS lookups through TOR, then DNS is anonymized. – B00TK1D May 01 '17 at 18:49