How can I check if my ISP is intercepting DNS queries sent to alternative DNS servers?
I have posted a detailed answer here because the questions are similar and that one is older.
In a nutshell:
The easiest method is to use Netalyzr (retired) android app or the Namebench windows software by Google. They will inform you if your ISP is using a DNS proxy. You don't need any technical knowledge for this.
-
Perform a DNS lookup to an authoritative nameserver and check if the reply is authoritative. For this example I will use
dig
. You can also usenslookup
too. If the reply is authoritative, dig will display theaa
flag in the reply. Now, a.ns.facebook.com is the authoritative NS of fb.me. If your ISP intercepts and redirects the request, you won't get an authoritative reply.dig @a.ns.facebook.com fb.me
specify an IP address where no DNS server is running, as the DNS server while performing
dig
ornslookup
. You will still receive reply if your ISP intercepts your request. Otherwise you will getTime Out
.Use nmap on random IP addresses. You will always see port 53 open, if your ISP redirects all port 53 requests.
Change your computer network settings and use Google public DNS or OpenDNS or Cloudflare DNS IP (Use one provider type at a time). Then go to Dns Leak Test website and notice if any different provider(s) is(are) appearing.
Related videos on Youtube
user68740
Updated on September 18, 2022Comments
-
user68740 over 1 year
Previously I had a router setup to use ISP provided DNS servers, but as of recently I setup two local DNS servers with forwarders set yo google's public dns. Whenever I visit a website which I assume is not yet cached in local DNS router reports a whole bunch of unreplied connections from local DNS server to google's dns server. At the same time internet speed is lagging until router stops reporting unreplied connections.
From what I have read this may be caused by ISP intercepting DNS queries, which I would love to check.
-
Ramhound about 9 years
-
user68740 about 9 yearsNot using their DNS servers is exactly what I am trying to do, but if they are intercepting DNS queries to public DNS servers and resolving those queries on their end then there isn't much I can do. Ever since switching back to ISP DNS servers as forwarders, there are also no unreplied connections and no issues with internet connections. Therefore, I assume, ISP is fiddling with DNS queries intended for any but their servers, but I was hoping to find a way to get more concrete evidence. Edit: I might try routing DNS queries through remote site using VPN, but that again wont prove much
-
Zoredache about 9 years@Ramhound he is talking about an ISP using something like NAT or route trickery to make something like Google's DNS be redirected to the ISP DNS servers. Something like this. serverfault.com/questions/672472/…
-
Zoredache about 9 yearsI would start by doing a traceroute to the servers you think may be intercepting. I think there are even tools that could do a UDP based traceroute with the port set to 53. See where the replies come from.
-
Ramhound about 9 years@Zoredache - I know what the author is talking about.
-
user68740 about 9 years@Zoredache I have tried tracert random websites that aren't cached in local dns yet with google's and ISP's dns servers set as forwarders. With ISP's DNS, there is no delay nor unreplied connections, whereas with google's there is a slight delay and unreplied connections. Regardless of which dns servers are used, first couple hops are the same. Another stupid test I did "nslookup website.com 8.8.8.8" is not consistent in timing, some requests taking longer than ever and again router reporting unreplied connections. Doesn't happen with ISP's DNS in place of 8.8.8.8
-
Scott - Слава Україні about 9 yearsuser68740: Zoredache isn't talking about running tracert to random websites, he's talking about running tracert to 8.8.8.8.
-
Julian Knight about 9 yearsHave you also tried OpenDNS instead of Googles DNS to see whether you have a poor route. I know from experience that sometimes Google's DNS is slower and sometimes OpenDNS is slower.
-
Sourav Ghosh almost 6 yearsPossible duplicate of How can I tell if my ISP is redirecting my DNS queries?
-