How to detect MITM on DNS?

I was going to say that conceptually there is no way to detect this except by seeing whether or not the replies are different from the truth as seen from elsewhere on the Internet (e.g. via DoH).

But then I remembered other cases of network interference and how we identified them, and I realized that there is a way:

Get a VPS server somewhere out on the Internet and install some kind of DNS server there (like BIND). Then connect to it from your ISP (sending it a DNS query) and see whether the VPS server actually receives your connection or not.

There are various ways to check that and various levels on which you could experiment. For example, you could make BIND or similar log queries and then see if your lookups generate a log entry or not (if you think the ISP might be outright blocking the connection and not attempting to proxy it). Or you could create a weird made-up zone that the server thinks it’s authoritative for and then query it directly for that zone, and see if you get the same records back. Or you could just have some other service listening on port 53 and see if the ISP allows you to connect to it (in the very simplest case, sudo nc -l 53 and nc myvps 53 and see if you can type back and forth between the two machines!).

4 Likes