@kubikpixel@chaos.social»Cloudflare zu Rekordstrafe verurteilt - das DNS als Zensur-Instrument:
Die italienische Regulierungsbehörde AGCOM hat @… mit einer Rekordstrafe überzogen, weil deren DNS Piratenseiten nicht blockiert«
Dies ist kritisch zu betrachten und doch ist im "offenen" Web einiges sehr umstritten. Was Piratenseiten sind oder nicht müssen wir uns nicht…
@timbray@cosocial.caNow officially shopping for an organization, ideally in Canada but absolutely out of US jurisdiction (Europe OK), to provide Web & DNS support. We have a few mostly-dormant WordPress blogs and static sites, a bunch of identity-supporting DNS records, and that's about it. Nothing very high-traffic, should be an easy ask. Would prefer something that demonstrates resilience and stability by having been around a few years.
@jtk@infosec.exchange"Today we’re opening the public preview of DNS over HTTPS (DoH) for Windows DNS Server."
https://techcommunity.microsoft.com/blog/networkingblog/secure-dns-with-doh-public-preview-for-windows-dns-server/44939…
@x_cli@infosec.exchange@… This is me again 😅
Using DoH, I get a weird EOF error during the dnshttp.Response conversion of the HTTP response.
The response was sent using the dnshttp.ResponseWriter implementation.
Digging into the implementation of the ResponseWriter, I see that you truncate the two leading bytes (response size) of TCP answers:
@mlncn@social.coophttps://defend612.com has been blocked at the domain name level for me and at least two other people over T-Mobile networks (which includes GoogleFi, MetroPCS, and… wait for it… Trump Mobile). For at least all day today.
Seems unlikely to be a technical problem but instead to be Actual Censorship (unless its not …
@heiseonline@social.heise.deBeschwerde: Karlsruhe stoppt umstrittene DNS-Überwachung einstweilig
Das Verfassungsgericht hat die Anordnung eines Amtsgerichts zur Überwachung von DNS-Anfragen auf eine bestimmte Domain nach Beschwerde des Providers ausgesetzt.
@bogo@hapyyr.comWe really need a new Internet. How do we help?
https://torrentfreak.com/italy-fines-cloudflare-e14-million-for-refusing-to-filter-pirate-sites-on-public-1-1-1-1-dns/
@catsalad@infosec.exchange
@aral@mastodon.ar.al🇵🇸 @small-tech/cross-platform-hostname module deprecated
https://www.npmjs.com/package/@small-tech/cross-platform-hostname
The release of version 1.1.0 deprecates and removes support for this small module that normalised hostname reporting between Linux/mac…
@offenenetze@chaos.socialGoogle-DNS-Sperren: Pariser Gericht stärkt Rechteinhaber gegen Streaming-Piraten | heise online
https://heise.de/-11138579
@x_cli@infosec.exchange@… I am using dnsv2 to develop a "mock" DNS server for my unit tests.
I noticed that when specifying Server.Listener or Server.PacketConn, you also need to specify Server.Net or you end up with a "bad network" error when calling ListenAndServe.
Specifying the Net property seems redundant when the PacketConn/Listener properties are specifie…
@ian@phpc.socialThe penultimate talk at #12Clouds is Akshay M talking about Agent Name Service (ANS), a DNS-like trust layer for AI agent deployments
@newsie@darktundra.xyzChina-aligned threat actor is conducting widespread cyberespionage campaigns https://therecord.media/china-aligned-threat-actor-espionage-network-devices
@Techmeme@techhub.socialItaly fines Cloudflare €14.2M for refusing to block pirate sites on its 1.1.1.1 DNS service; CEO Matthew Prince says he will discuss it with US officials (Jon Brodkin/Ars Technica)
https://arstechnica.com/tech-policy/20
@hanno@mastodon.socialGerman ministry renames itself, domain expires, is bought by SEO-spammer, expires again, is bought by domain grabber, then later bought by itsec company who now learns that apparently plenty of internal systems of the ministry still try to connect to the domain...
I don't even know where to start how terrible that is and what it tells us about government IT security practices...
@shaun@mastodon.xyz
@metacurity@infosec.exchangeMetacurity operates beyond the infosec news echo chamber to unearth sources and stories that the big guys overlook.
Check out today's issue for infosec developments you might have missed over the weekend, including
--Pentagon challenges Anthropic over mass surveillance, autonomous weapons curbs,
--UK moves to tighten online safety laws after xAI's Grok debacle,
--Iran is spying on and retaliating against protestors,
--DHS is seeking to spy on anti-ICE soc…
@maxheadroom@hub.uckermark.socialWhoops, MullvadVPN DNS blocker for social media also blocks my own Mastodon instance 😳
@Mediagazer@mstdn.socialItaly fines Cloudflare €14.2M for refusing to block pirate sites on its 1.1.1.1 DNS service; CEO Matthew Prince says he will discuss it with US officials (Jon Brodkin/Ars Technica)
https://arstechnica.com/tech-policy/20
@cketti@social.int21.devI just finished reorganizing the cable drawer.
The timeline of events was something like:
- the DNS server for internal name resolution runs inside a Docker container only reachable via IPv4
- if an Android device gets both IPv4 and IPv6 DNS servers, it will only query the IPv6 one
- fuck Docker; I'll install the DNS server on a Raspberry Pi
- creating a Pi image with sshd enabled didn't work
- this household has surprisingly few HDMI cables
- oh, …
@cketti@int21.devI just finished reorganizing the cable drawer.
The timeline of events was something like:
- the DNS server for internal name resolution runs inside a Docker container only reachable via IPv4
- if an Android device gets both IPv4 and IPv6 DNS servers, it will only query the IPv6 one
- fuck Docker; I'll install the DNS server on a Raspberry Pi
- creating a Pi image with sshd enabled didn't work
- this household has surprisingly few HDMI cables
- oh, …
@fanf@mendeddrum.orgfrom my link log —
The case of the missing DNS packets.
https://cloud.google.com/blog/topics/inside-google-cloud/google-cloud-support-engineer-solves-a-tough-dns-case
saved 2020-05-13
@selea@social.linux.pizza
@qbi@freie-re.de"Ich habe einen DNS-Namen bekommen."
"Und ... wie heißt du jetzt?"
#krautspaceleaks
@heiseonline@social.heise.deCloudflare-Rekordstrafe: Italiens harter Anti-Piraterie-Kurs trifft DNS-Resolver
Wegen verweigerter Netzsperren verhängt der italienische Regulierer Agcom ein Bußgeld in zweistelliger Millionenhöhe gegen den Infrastrukturriesen Cloudflare.
@rasterweb@mastodon.socialI recently got a “new” iPad (meaning, a used model from 2020) and I was amazed at how terrible it was for web browsing. Then I realized I forgot to point it at my Pi-hole install for DNS.
So much of the (commercial) web is nearly unusable on old(er) devices because of the amount of advertising crammed onto a page.
(Indie sites personal blogs, etc are mostly unaffected. Recipe sites though… whew!)
#web
@jtk@infosec.exchangeWeekend Reads
* 5G in Latin America
https://www.ookla.com/articles/5g-in-latin-america-pockets-of-progress
* Evaluating DNS resiliency
@jamesthebard@social.linux.pizza
@piger@mastodon.socialadded hn and lobsters to the dns deny list. Firefox "failed to load page" will be my reminder that even staring at the wall will be more useful than reading those 2 sites
@rmdes@mstdn.socialNew to Indiekit? Read the full deployment guide — a step-by-step walkthrough covering server setup, DNS, configuration, first-run password creation, syndication, webmentions, and the full plugin set.
https://github.com/rmdes/indiekit-deploy/blob/main/docs/deployme…
@frankstohl@mastodon.social
@usul@piaille.frWhat came first: the CNAME or the A record?
https://blog.cloudflare.com/cname-a-record-order-dns-standards/
@cdamian@rls.socialI moved my DNS and mostly static sites from AWS to @…
It was a bit of a hassle, and I have to be a Linux admin again (AWS hosted via Route53 S3 magic)
https://webcam.calpenedes.com/
@mapto@qoto.orgThe bureaucratic rigidness of the Italian government has taken it to a completely unnecessary conflict with US providers. With the poorly-planned Privacy Shield initiative, it entered a digital sovereignty conflict the country never prepared for. The appalling thing is that even the outspoken Mario Draghi didn't try to walk his talk. And now Cloudfare threatens to resist.
"The scheme, which even the EU has called concerning, required us within a mere 30 minutes of notification…
@beoz@det.social@… und wenn schon sollte man sollte man die DNS Einträge der UEFA/FIFA sperren. Die Schaden unserem Ruf als Schweizer Verein. Gemeinnützig ist ihr Gehabe wohl eher nicht.
@offenenetze@chaos.socialCloudflare-Rekordstrafe: Italiens harter Anti-Piraterie-Kurs trifft DNS-Resolver | heise online
https://heise.de/-11136843
@ripienaar@devco.socialSweet next year letsencrypt will support a persisting DNS record so these tools don’t need access to DNS for renewal
@frankel@mastodon.topThe Pi-hole® is a #DNS sinkhole that protects your devices from unwanted content, without installing any client-side software
https://pi-hole.net/
@fanf@mendeddrum.orgfrom my link log —
The disappearing Windows DNS debug log.
https://nxlog.co/disappearing-windows-dns-debug-log
saved 2019-01-10 https://
@x_cli@infosec.exchangeTu sais que t'es en train d'aller trop loin quand pour tester une fonctionnalité de ton programme (un client SSH), tu te retrouves Š implémenter un serveur SSH, un serveur DNS et un serveur HTTP et une PKI pour ton test E2E.
Heureusement, c'est facile Š faire en Go 😅
@wyri@toot-toot.wyrihaxim.us@… and this is why I ran ad blocking on the DNS level. And browser addons that deal with most of these crappy modals
@zachleat@zachleat.comDNS stands for “DO NOT meSs with this or you’re going to have a bad time”
@stf@chaos.socialchapeau, weather-over-dns-over-mastodon:
@… berlin.now.weather.dyn.bortzmeyer.fr TXT
this is the way.
@pavelasamsonov@mastodon.socialTao Te Ching: The tao that can be told is not the eternal Tao. The name that can be named is not the eternal Name.
Paul Mockapetris: that's going to make it really hard to issue you a DNS address
@jtk@infosec.exchangeI can help but feel this "feature" should raise more concerns than it does alleviate them.
"Accelerated recovery for managing public DNS records addresses this need by targeting DNS changes that customers can make within 60 minutes of a service disruption in the US East (N. Virginia) Region."
@maxheadroom@hub.uckermark.socialThe Pihole instance running on my laptop blocks about 21% of the DNS requests …. This is self-defense …
#Pihole #Enshittification
@EarthOrgUK@mastodon.energyOn Website Technicals (2021-02) - Tech updates: image preview tweak for dark mode, DNS secondary fun. - https://m.earth.org.uk/note-on-site-technicals-45.html
@timbray@cosocial.caTFW you notice that your Synology-local-backup to cloud-backup hasn't been working since you moved in October 2024 because you’d stupidly hardwired the Synology DNS to the former residence’s now-wrong 192.168. Would have been sad if the house burned down. Would have been nice if the Synology had complained.
Discovered this in the course of a search for a non-US (ideally Canadian) Synology-friendly cloud backup. Promising: eazyBackup and ionos.ca HiDrive.
@stev3yd@social.linux.pizzaIf you ever want to hear your family come to life. Take down the home DNS server lol. #DNS
@grumpybozo@toad.socialMS365 email cannot achieve “four nines” availability for 2026.
They’ve been down for long enough today that they’re more than halfway to losing the third 9. It's DNS.
The biggest mail system I help manage had NO unplanned downtime in 2025 & the planned downtime (kernel updates) was less than 0.004%
The biggest DNS environment I help manage has had 100% availability for >5y. It has NEVER returned SERVFAIL for a valid name.
Sadly, I do not scale. And I am o…
@mgorny@social.treehouse.systemsSo I was pretty enthusiastic about #DNS4EU at first.
Then I've discovered it blocklisted some random pastebin. Well, it happens. I mean, pastebins frequently get into trouble because of people pasting random shit. So I've filed an unblock request. I've suddenly got a mail to confirm registration in some random company's system — I suspect it was related to DNS4EU, but no clear indication. I've ignored it.
Then they've blocklisted my mail provider, for no apparent reason. It's still blocked. I've switched to the "unfiltered" version to be able to access my mail again.
Today I've gotten a mail via my backup MX. My main MX is up. My educated guess is that sysadmins using DNS4EU now get my mail redirected to their "site blocked" server. Isn't that great?
PS. Maybe if more people filed unblock requests for "poczta.ftdl.pl", it would help. It's a non-profit e-mail provider.
#DNS #ItsAlwaysDNS
@hacksilon@infosec.exchangeSeems like this could be useful for some #Selfhosted / #HomeLab folks. https://m.vinduv.app/@VinDuv/115940541
@thoralf@soc.umrath.netGibt es eigentlich irgendeinen DNS-ANbieter, der wie Cloudflare CNAME-Einträge auf den Domainnamen selbst zulässt bzw. diese (wie bei Cloudflare) dynamisch in reguläre Eintrage übersetzt?
@fanf@mendeddrum.orgfrom my link log —
Can I use HTTPS RRs?
https://www.netmeister.org/blog/https-caniuse.html
saved 2025-12-12 https://dotat.at/…
@cketti@social.int21.devI fell down the self-hosting (at home) rabbit hole.
Current status: Had to disable the IPv6 router advertisement option for DNS configuration 🙁
@cketti@int21.devI fell down the self-hosting (at home) rabbit hole.
Current status: Had to disable the IPv6 router advertisement option for DNS configuration 🙁
@theodric@social.linux.pizzaBrief Starlink outage (our second ever). Strange that throughout I could ping 1.1.1.1 but not 9.9.9.9 or any other Internet host for which I have the IP saved. I reckon this means Cloudflare has a DNS instance in the same DC/on a peering fabric adjacent to the Starlink "Dublin" (LDNGBR) ground station.
@thomasfuchs@hachyderm.ioYou'd think that Gracenote must be one of the oldest APIs still working but there's basic Internet protocols that are way older, like NTP or DNS
@rmdes@mstdn.socialYay, my bluesky domain handle now pass verification for both DNS and HTTP https://bsky-debug.app/handle?handle=rmendes.net
@ayn@trunk.lolmoved dns hosting for trunk.lol from DME to porkbun (free), lmk if you see any issues.
@Szwendacz@social.linux.pizzaCurrently most biggest email providers put mails from my domain in TLD .cloud and my server to spam. Even tho I have all the shiny things set up like SPF, DKIM, DMARC, reverse dns, the domain is not new, and there was never spam sent from my server. I am not on any blacklist of course.
And I don't get why ppl actually don't check what is in spam folder, like they really receive so much spam, so that they can't notice there is something? I have plenty of mail accounts in var…
@jamesthebard@social.linux.pizzaStarted migrating services off of the RPis and onto the new #Proxmox server. The initial install went fairly smoothly, got the VLANs configured, and then setup the new primary DNS server. That took longer than it should have, but I will say this: the VM is so much more snappy than the Pi. Next up is the secondary DNS server.
@keen456@infosec.exchange
@doebeli@mastodon.socialWer kennt einen kompetenten CH-Provider, der mir nicht ohne Info an mich den Webserver abschaltet und den DNS-Eintrag mit einer TTL von 24h auf 127.0.0.1 setzt, weil Bots (Petalbot und ahref-Bot) so viele meiner statischen Webseiten abrufen, dass der von mehreren Kunden genutzte Server abraucht?
(Technische) Details der Story: …
@luana@wetdry.worldThis girl now self-hosts her DNS!!
https://github.com/LuNeder/nixos-config/commit/7c5358fd4de441e4bb5011fb90f182bbbfb6bd28
@pkraus@berlin.socialToday I learned how to use socat to pipe IPv4 traffic to my #homelab that's accessible only over IPv6 (thanks 1&1 and DS-Lite).
Set the DNS A record to a VPS I already have, spin up a reverse proxy on the VPS via docker, point the right domains to a socat docker container which TCP6's the IPv4 traffic the right way. Don't forget to add an IPv6 network to the socat container. Done.
@life_is@no-pony.farm@why_not@mastodon.social ich finde die vorstellung, dass, sagen wir 33,34% der Bevölkerung [Deutschlands|EU|Europas|des Westens|der Industrienationen|der demokratidchen Staaten|des globalen Nordens] bereit sein könnte wegen was-auch-immer Alphabet, Amazon und Microsoft zu boykottieren bizarr. Teilweise unmöglich. Alphabet bietet DNS 8.8.8.8 und 8.8.4.4 und das pandemie-traceing-network an. https://mamot.fr/@Khrys/116034466199737167
@Life_is@no-pony.farm@why_not@mastodon.social ich finde die vorstellung, dass, sagen wir 33,34% der Bevölkerung [Deutschlands|EU|Europas|des Westens|der Industrienationen|der demokratidchen Staaten|des globalen Nordens] bereit sein könnte wegen was-auch-immer Alphabet, Amazon und Microsoft zu boykottieren bizarr. Teilweise unmöglich. Alphabet bietet DNS 8.8.8.8 und 8.8.4.4 und das pandemie-traceing-network an. https://mamot.fr/@Khrys/116034466199737167
@fanf@mendeddrum.orgfrom my link log —
Route 53 DNS: Amazon’s premier AWS database.
https://www.lastweekinaws.com/blog/route-53-amazons-premier-database/
saved 2021-02-18 <…
@deepthoughts10@infosec.exchangeWhat? No discussion of the #Microsoft email outage? Surely someone will bring out the DNS Haiku. #outage
@EarthOrgUK@mastodon.energyOn Website Technicals (2025-10) - Tech updates: Sitebulb AdSense fails, RSS description, lite ads, ISSN lookup, micro-opts, DNS broke intensity, SVG inline URL-encoded, CO2 pcm, flock. - https://m.earth.org.uk/note-on-site-technicals-101.html
@jamesthebard@social.linux.pizza
@me@mastodon.peterjanes.caFun little experiment: block html-load[.]com and error-report[.]com at the DNS level and watch the web become unusable.
@johndoe@social.linux.pizza@… yeah, ofcourse. AWS and Azure has DNS problems within 1 week of each other and now cludflare was down. Maybe it was DNS, but there is for sure more to the story that we do not know.
@dawid@social.craftknight.com @fanf@mendeddrum.orgfrom my link log —
trustydns: DNS Over HTTPS proxy, server and query programs.
https://github.com/markdingo/trustydns
saved 2019-06-28 https://do…
@jtk@infosec.exchangeThere are four .ir TLD nameservers, three of which are located behind IRNIC and have been generally unavailable outside of Iran (not sure about in-country).
One auth NS (c.nic.ir.) is operating behind #AS48011 outside of Iran and is responding to queries.
However, from what I can see from the SOA RRs for the zone captured by passive DNS, c.nic.ir does not currently appear to be in s…
@vartak@mastodon.online@… @… It’s not vanity. It is a kind of identity verification - since in order to use a domain name as an ID you have to have access for the domains DNS records. Which means you have an ICANN registration.
@danyork@mastodon.social @x_cli@infosec.exchange@… Hey, it is me again 😅
Just to let you know that I receive some 400 Bad Request errors from some DoH servers (dns.quad9.net and ns0.fdn.fr for instance) while some others accept my queries (dns.google and Cloudflare 1.1.1.1).
I am not sure yet if the error is on my use of the library or within the library itself.
Here is the code to run the query:
@fanf@mendeddrum.orgsupport for DNS-over-TCP has been explicitly necessary since 2010
it's irritating that we still have to keep explaining this https://lobste.rs/c/hatmxu
@frankel@mastodon.topYesterday, I managed to 1) install #PiHole on a #RaspberryPi behind in my #Tailscale mesh and configure the #DNS to…
@fanf@mendeddrum.orgfrom my link log —
Internet world despairs as non-profit .org sold for $$$$ to private equity firm.
https://www.theregister.co.uk/2019/11/20/org_registry_sale_shambles/
saved 2019-11-23
@x_cli@infosec.exchangeMany #Terraform providers using SSH do not check the SSH host key... they just run with ssh.InsecureIgnoreHostKey...
And to be honest, it is partly the fault of the SSH standard library which makes it super easy to ignore the host key and does not provide any useful builtin key verification function. People are lazy. ssh.FixedHostKey is niche.
So I implemented a small library to v…
@fanf@mendeddrum.orgfrom my link log —
Gonemaster: a Golang clone of the Zonemaster DNS checker.
https://codeberg.org/pawal/gonemaster
saved 2026-01-26 https://dotat.…
@luana@wetdry.worldDoes anyone actually use OpenNIC?
I selfhost my DNS with unbound, apparently it's simple to use OpenNIC's root server hints but then you remove ICANN ones.
I know OpenNIC's root servers also respond for ICANN domains, but what I was wondering is: can I use ICANN ones for ICANN domains and only use OpenNIC ones when ICANN root servers don't know about a TLD?
#OpenNIC
