<div dir="auto"><div>What you're seeing is quite expected, you're providing a relative domain name not an absolute one. Since it is relative, then the DNS resolver will try to use the list of search domains it has to resolve it.</div><div dir="auto"><div dir="auto"><br></div><div dir="auto">The purpose of providing a domain to a client e.g. via DHCP is so that relative names can be used for things.</div><div dir="auto"><br></div><div dir="auto">In the ISP world, it would be so that customers can type "mail" rather than "<a href="http://mail.isp.com">mail.isp.com</a>". I don't think that is really much value anymore, as the only place people commonly type domain names its into their web browser, and they're full domain names outside the ISP's name space, even though they're technically not fully qualified - a fully qualified domain name has a dot on the end e.g. "<a href="http://mail.isp.com">mail.isp.com</a>.". Also, ISPs provide full (relative) names on settings pages too.</div><div dir="auto"><br></div><div dir="auto">So you have the following options</div><div dir="auto"><br></div><div dir="auto">(a) always use fully qualified domain names i.e. ones that have dots on the end - which is impractical because it will be hard to change end user behaviour.</div><div dir="auto"><br></div><div dir="auto">(b) work out where your resolver relative search list is and stop it listing .com.au. Something to try is to have a single search domain of '.', which would make all relative domain names absolute ones upon the first resolution attempt.</div><div dir="auto"><br></div><div dir="auto">Try your nslookup query with a dot on the end and it should either entirely succeed or entirely fail on the first resolution attempt.</div><br><div class="gmail_extra" dir="auto"><br><div class="gmail_quote">On 1 Jun. 2017 17:38, "Benjamin Ricardo" <<a href="mailto:ben.ricardo@acs.net.au">ben.ricardo@acs.net.au</a>> wrote:<br type="attribution"><blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-AU" link="#0563C1" vlink="#954F72">
<div class="m_-7987994814479250962WordSection1">
<p class="MsoNormal"><span style="color:#1f497d">Ahh yes I hadn’t thought of the catchall.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">You are correct Nick there is still an old 2003 DC in this domain and yes since Win7 / Server2k8r2 the devolution level criteria has changed– this will have been the issue I guess.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">I thought the client controlled the DNS Devolution level though and these clients are Win10?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Win10 client querying against a 2008R2 DNS Servers<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Example (you asked for it)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">PS C:\> nslookup<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Default Server: nameserver<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Address: 192.168.23.10<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">> set debug<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">> <a href="http://vpn.somedomain.com" target="_blank">vpn.somedomain.com</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Server: nameserver<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Address: 192.168.23.10<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">------------<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Got answer:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> HEADER:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> opcode = QUERY, id = 2, rcode = NXDOMAIN<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> header flags: response, auth. answer, want recursion, recursion avail.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> questions = 1, answers = 0, authority records = 1, additional = 0<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> QUESTIONS:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> <a href="http://vpn.somedomain.com.somedomain.com.au" target="_blank">vpn.somedomain.com.somedomain.<wbr>com.au</a>, type = A, class = IN<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> AUTHORITY RECORDS:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> -> <a href="http://somedomain.com.au" target="_blank">somedomain.com.au</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> ttl = 3600 (1 hour)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> primary name server = <a href="http://sterdevel.somedomain.com.au" target="_blank">sterdevel.somedomain.com.au</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> responsible mail addr = hostmaster. <a href="http://somedomain.com.au" target="_blank">somedomain.com.au</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> serial = 185662<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> refresh = 900 (15 mins)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> retry = 600 (10 mins)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> expire = 86400 (1 day)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> default TTL = 900 (15 mins)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">------------<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">------------<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Got answer:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> HEADER:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> opcode = QUERY, id = 3, rcode = NXDOMAIN<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> header flags: response, auth. answer, want recursion, recursion avail.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> questions = 1, answers = 0, authority records = 1, additional = 0<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> QUESTIONS:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> vpn. <a href="http://somedomain.com" target="_blank">somedomain.com</a>. <a href="http://somedomain.com.au" target="_blank">somedomain.com.au</a>, type = A, class = IN<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> AUTHORITY RECORDS:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> -> <a href="http://somedomain.com.au" target="_blank">somedomain.com.au</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> ttl = 3600 (1 hour)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> primary name server = sterdevel. <a href="http://somedomain.com.au" target="_blank">somedomain.com.au</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> responsible mail addr = hostmaster. <a href="http://somedomain.com.au" target="_blank">somedomain.com.au</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> serial = 185662<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> refresh = 900 (15 mins)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> retry = 600 (10 mins)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> expire = 86400 (1 day)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> default TTL = 900 (15 mins)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">------------<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">------------<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Got answer:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> HEADER:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> opcode = QUERY, id = 4, rcode = NOERROR<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> header flags: response, want recursion, recursion avail.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> questions = 1, answers = 1, authority records = 0, additional = 0<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> QUESTIONS:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> vpn. <a href="http://somedomain.com.com.au" target="_blank">somedomain.com.com.au</a>, type = A, class = IN<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> ANSWERS:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> -> vpn. <a href="http://somedomain.com.com.au" target="_blank">somedomain.com.com.au</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> internet address = 192.185.161.219<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> ttl = 4021 (1 hour 7 mins 1 sec)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">------------<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Non-authoritative answer:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">------------<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Got answer:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> HEADER:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> opcode = QUERY, id = 5, rcode = NOERROR<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> header flags: response, want recursion, recursion avail.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> questions = 1, answers = 0, authority records = 1, additional = 0<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> QUESTIONS:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> vpn. <a href="http://somedomain.com.com.au" target="_blank">somedomain.com.com.au</a>, type = A, class = IN<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> AUTHORITY RECORDS:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> -> <a href="http://com.com.au" target="_blank">com.com.au</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> ttl = 900 (15 mins)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> primary name server = <a href="http://ns1255.websitewelcome.com" target="_blank">ns1255.websitewelcome.com</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> responsible mail addr = <a href="http://root.harrier.websitewelcome.com" target="_blank">root.harrier.websitewelcome.<wbr>com</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> serial = <a href="tel:(201)%20705-1610" value="+12017051610" target="_blank">2017051610</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> refresh = 86400 (1 day)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> retry = 7200 (2 hours)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> expire = 3600000 (41 days 16 hours)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> default TTL = 86400 (1 day)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">------------<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Name: vpn. <a href="http://somedomain.com.com.au" target="_blank">somedomain.com.com.au</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Address: 192.185.161.219 <wbr>
</span><span style="color:red"><- this is the wrong address</span><span style="color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Nick Marsham [mailto:<a href="mailto:nick@c2conline.com.au" target="_blank">nick@c2conline.com.au</a>]
<br>
<b>Sent:</b> Thursday, 1 June 2017 3:52 PM<br>
<b>To:</b> Benjamin Ricardo <<a href="mailto:ben.ricardo@acs.net.au" target="_blank">ben.ricardo@acs.net.au</a>>; 'Ausnog' <<a href="mailto:ausnog@lists.ausnog.net" target="_blank">ausnog@lists.ausnog.net</a>><br>
<b>Subject:</b> RE: [AusNOG] DNS Devolution targeting the .com.au space - should we be worried?<u></u><u></u></span></p>
</div>
</div><div class="elided-text">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">DNS devolution in AD domains in all supported versions of Windows doesn’t proceed past the FQDN of the forest root domain, so the only way you could get into this exact scenario is by your FRD configured as “com.au”, or to have a global
search suffix list configured which includes the suffix “com.au”, since global search suffix lists override devolution.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">If you‘re able to provide me an example of how devolution could actually cause the scenario you suggest in Windows 7/Server 2008R2 or newer, I’d be very interested.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">It’s also important to note that the owner <a href="http://com.com.au" target="_blank">com.com.au</a> is not explicitly “registering” A records in order to catch big-name companies: Their DNS server simply has a ‘catchall’ which returns a landing page.<u></u><u></u></p>
<p class="MsoNormal"><a name="m_-7987994814479250962__MailEndCompose"><u></u> <u></u></a></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> AusNOG [</span><a href="mailto:ausnog-bounces@lists.ausnog.net" target="_blank"><span lang="EN-US">mailto:ausnog-bounces@lists.<wbr>ausnog.net</span></a><span lang="EN-US">]
<b>On Behalf Of </b>Benjamin Ricardo<br>
<b>Sent:</b> Thursday, 1 June 2017 3:36 PM<br>
<b>To:</b> 'Ausnog' <</span><a href="mailto:ausnog@lists.ausnog.net" target="_blank"><span lang="EN-US">ausnog@lists.ausnog.net</span></a><span lang="EN-US">><br>
<b>Subject:</b> [AusNOG] DNS Devolution targeting the .com.au space - should we be worried?<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">HI All,<u></u><u></u></p>
<p class="MsoNormal">Looking for thoughts on something that we uncovered today in the wild (heard about it years ago but never seen it) regarding internal company domains that are using public .com.au domain suffixes and whether there’s something that should
be done here.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The issue is caused by Microsofts Primary DNSSuffix Devolution and the potential for legitimate traffic to be redirected to the owner of the domain “com.com.au.” if your machine has a domain name of “<a href="http://somehostname.somedomainname.com.au" target="_blank">somehostname.somedomainname.<wbr>com.au</a>”<u></u><u></u></p>
<p class="MsoNormal">It is possible in this situation for a non-qualified query to do the following:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><a href="http://ibm.com.somehostname.somedomainname.com.au" target="_blank">ibm.com.somehostname.<wbr>somedomainname.com.au</a> (NXDOMAIN)<u></u><u></u></p>
<p class="MsoNormal"><a href="http://ibm.com.somedomainname.com.au" target="_blank">ibm.com.somedomainname.com.au</a> <wbr> <wbr> (NXDOMAIN)<u></u><u></u></p>
<p class="MsoNormal"><a href="http://ibm.com.com.au" target="_blank">ibm.com.com.au</a> <wbr> <wbr> <wbr> (NOERROR)<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">You can see the vulnerability.<u></u><u></u></p>
<p class="MsoNormal">The problem is now that it appears that the owner of the domain “<a href="http://com.com.au" target="_blank">com.com.au</a>” has started to register A records for big name domains such as .<a href="http://ibm.com" target="_blank">ibm.com</a> in the hope of catching non-fully qualified queries to these addresses.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I can only think that this is going to end badly for people.<u></u><u></u></p>
<p class="MsoNormal">Is this the sort of thing that could be flagged as abuse?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Appreciate any comments.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Ben<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div></div>
</div>
<br>______________________________<wbr>_________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">http://lists.ausnog.net/<wbr>mailman/listinfo/ausnog</a><br>
<br></blockquote></div><br></div></div></div>