NXDOMAIN DNS Results Flagged As "Possible DNS-rebind attack detected" In Log

[HarryMuscle]

I'm using ControlD DNS servers to block ads and I have Enable DNS Rebind Protection set to Yes on the WAN page, however, whenever a blocked domain gets queried (which ControlD returns NXDOMAIN for) I get the following message in my logs:

DATE dnsmasq[1729]: possible DNS-rebind attack detected: domain.com

Is there a way to quiet these incorrect log messages? Or better yet fix the problem, since a NXDOMAIN DNS result isn't a rebind attack?

Thanks,
Harry

 

[dave14305]

Or it returns 0.0.0.0 which is considered a rebind attack and dnsmasq is subsequently returning NXDOMAIN to you.

# dig ad.doubleclick.net @76.76.2.2

; <<>> DiG 9.18.10 <<>> ad.doubleclick.net @76.76.2.2
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43392
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;ad.doubleclick.net.            IN      A

;; ANSWER SECTION:
ad.doubleclick.net.     60      IN      A       0.0.0.0

;; Query time: 29 msec
;; SERVER: 76.76.2.2#53(76.76.2.2) (UDP)
;; WHEN: Wed Jan 11 21:17:47 EST 2023
;; MSG SIZE  rcvd: 52

Best to disable rebind protection if using an ad-blocking DNS service upstream.

 

[ColinTaylor]

Are you sure it's returning NXDOMAIN? That wouldn't normally generate a rebind message. There was a recent discussion about NextDNS returning 0.0.0.0 for blocked domains which will trigger a rebind warning.

https://www.snbforums.com/threads/m...ter-decide-which-one-to-use.82014/post-804869

 

[bbunge]

Wouldn't it be a whole lot easier to just run Diversion or a Pi with Pi-Hole?

 

[HarryMuscle]

Wouldn't it be a whole lot easier to just run Diversion or a Pi with Pi-Hole?

You mean instead of using ControlD? Definitely no. ControlD is a few clicks and everything is done. Running PiHole is way more work.

 

[HarryMuscle]

Are you sure it's returning NXDOMAIN? That wouldn't normally generate a rebind message. There was a recent discussion about NextDNS returning 0.0.0.0 for blocked domains which will trigger a rebind warning.

https://www.snbforums.com/threads/m...ter-decide-which-one-to-use.82014/post-804869

Turns out the bogus-nxdomain configuration entry mentioned in that thread solved the issue. So I guess they do return 0.0.0.0 instead of NXDONAIN like they (or someone somewhere when I Googled) claim.