5

Out of curiosity, I entered dig . today. To my surprise, I got an IP:

$ dig .

; <<>> DiG 9.10.3-P4-Ubuntu <<>> .
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45964
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;.                              IN      A

;; ANSWER SECTION:
.                       291     IN      A       172.217.23.174

;; Query time: 150 msec
;; SERVER: 10.0.0.138#53(10.0.0.138)
;; WHEN: Fri Feb 22 18:03:53 STD 2019
;; MSG SIZE  rcvd: 33

Now, this IP seems to belong to Google, and http://172.217.23.174/ actually redirects to http://www.google.com/.

However, trying this repeatedly gave me different IPs: 52.95.34.225 (Amazon), 157.240.1.13 (Facebook), 52.114.128.9 (Microsoft), 23.195.9.143 (Akamai), and others... (this actually reads like the who-is-who of Internet companies!)

Googling each of them never revealed anything special other than the organization they belong to.

So, now I'm even more curious: Where are these IPs coming from? And what does dig . actually do? It seems to query the "DNS root" which, as I understand, shouldn't have random A records...

CherryDT
  • 534

1 Answers1

2

Yes, . refers to the DNS "root". Yes, . is not supposed to have any record types other than NS and SOA (plus DNSSEC-related RRSIG/DNSKEY if you query with the +dnssec option).

So in this case, you're sending the queries to 10.0.0.138 (which is a private address in your LAN), and it's sending you completley made-up replies. You should investigate who owns that host on your LAN, and why it's configured as your DNS server to begin with.

(Interestingly, it still includes the ad (authenticated data) flag, implying that it had DNSSEC-verified the records before responding, which is just more lies and a reminder to not trust the 'ad' flag.)

grawity
  • 501,077