DNS error - some sort of clash?

[watercooled]

So this is a really rare one but I've seen it happen a few times over the years. Type in the name of a common website and get directed to something completely different, but with the same URL. And no, this is not because of a typo, but that would be my first reaction too.

So, any ideas how that would happen? Depending how it happens I imagine it could have some security implications.

Edit: I did post an example but it was due to a typo but pretty sure I've had it happen in the past where I've literally just pressed F5 and it's gone to the correct page.

[DanceswithUnix]

It can just be stale DNS or config entries as the internet adjusts to some poorly implemented config change. Web servers can serve lots of websites, and someone having a moment with a config file can send you to the wrong one.

Probably wouldn't happen to you, but the thing to look out for is malware redirecting you. I've seen machines that implement all sorts of dns redirection and url skimming to eg point you at ads they make revenue from. Last machine I saw like that I just booted from a Linux DVD (because that sucker is read only) to wipe the disk and start again. Damned machine was like something from the exorcist

[watercooled]

Yeah I've seen it happen on the "can you have a look at my laptop please" systems which are obviously malware redirects, but this is something different I've seen. It is extremely rare though.

It didn't actually happen this time of course, it just reminded me. Come to think of it I've not seen it happen for years now.

It wasn't even a case of being sent a completely different page, rather the 'wrong' page even had the same title. I'll give you one example from many years ago, and it happened multiple times so stuck in my mind. I was aiming for runescape.com (don't judge me, it was a long time ago) and ended up on a website called run escape. I can only guess there used to be a website called 'run escape' and the URL was purchased for Runescape and somehow I was being served that page.

[AGTDenton]

I had this a while back when I was still on ADSL, I forget who the provider was at the time.

Who's DNS server are you using?

I've actively been moving away from Google, I don't like that the default DNS on my ASUS router is Googles

I've been experimenting with a couple of Malware blocking DNS servers:

https://en.wikipedia.org/wiki/1.1.1.1


When my health is restored I'm aiming to build my own DNS server

[kalniel]

It can be ISP controlled too. One of the annoyances I found out about my recent provider is they don't allow users to chose a DNS server, I have to use the ISP's.

[watercooled]

It was most likely Virgin's own resolvers. I have flicked between a few DNS providers over the years but Virgin's are generally fine (and fast) as long as you disable the silly redirects for typos. You also get the benefit of getting generally optimal routing to closer CDNs which third-party DNS can sometimes break.

@Kalniel: Is that one of the major providers? Seems like an odd requirement.

[kalniel]

It was most likely Virgin's own resolvers. I have flicked between a few DNS providers over the years but Virgin's are generally fine (and fast) as long as you disable the silly redirects for typos. You also get the benefit of getting generally optimal routing to closer CDNs which third-party DNS can sometimes break.

@Kalniel: Is that one of the major providers? Seems like an odd requirement.

It's Virgin in fact - you can set anything you like and it'll still route through their DNS servers.

[watercooled]

How do you mean, because that's not the case for me? If I set 1.1.1.1 or 8.8.8.8, that's what I get. I even get markedly different results, hence my comment about the CDNs.

[kalniel]

How do you mean, because that's not the case for me? If I set 1.1.1.1 or 8.8.8.8, that's what I get. I even get markedly different results, hence my comment about the CDNs.

I'm probably mistaken then! Do you manage to avoid Virgin DNS appearing at all on an extended dnsleak test? https://www.dnsleaktest.com/

[watercooled]

If I set 1.1.1.1 it just shows Cloudflare? I did take a screenshot but Imgur complaining about being overloaded or something.

[kalniel]

I believe you I'm clearly mistaken.

[watercooled]

Were you setting it through DHCP or directly on the computers?

[kalniel]

Were you setting it through DHCP or directly on the computers?

Via window's network adaptor settings, which I am absolutely not an expert on. What's the proper way?

[watercooled]

That should be it. DHCP should be fine too but I wondered if VM's router might be interfering with that somehow, but I don't think it even allows you to change in on their own router, come to think of it.

Under IPv4 properties, just put the IPs for your preferred primary and secondary DNS servers. That should be respected and a quick way to test is on a command prompt; type nslookup, then see what it says about the default server. You can then type domain names to see how the server responds.

[dannyboy75]

I just booted from a Linux DVD (because that sucker is read only)

Takes me back around 10 years ago when I was doing support for the UK office of an antivirus company. I spent about 90 minutes on the phone to a guy who, having had a minor adware/scareware infection, reformatted but was convinced that it had infiltrated his read-only Windows installation CD's/DVD's. It was the most frustrating and mentally exhausting 90 minutes of my (18 years and counting) IT career, trying to reason with someone who thought they were quite knowledgeable and wouldn't listen to a word I said. I vowed from that day to never take another job dealing with Joe Public.

Also, watercooled, unless I'm missing something, wouldn't it better still to configure these DNS servers on your router? I'm also with VM and use Cloudflare's DNS servers (1.1.1.1 and 1.0.0.1) - though admittedly I only use the VM router in bridge/modem mode, as I use my own Asus router.

Ah, soz. As I type this, just noticed you say it's not possible to change DNS servers on VM's router. Makes sense.

[DanceswithUnix]

I believe you I'm clearly mistaken.

AIUI with Virgin you could both be right, as it is still a mess of small companies that were bought up by NTL over a period of years and never fully integrated into a coherent single system. So in a different town, different rules could apply.