How website detects DNS resolver?
-
Hello! I recently tried NextDNS and noticed that is detects my current DNS resolved on the go. I just opened its website and it immediately showed my current resolver:
When I tried changing private DNS to Cloudflatein settings it instantly showed my new resolver.
But how exactly it works? Does the browser send used DNS server to website? Or it is done somehow via JavaScript?
And also: So every website can know what I am using now? Can it be used for fingerprinting? -
P [email protected] shared this topic
-
[email protected]replied to [email protected] last edited by
Without looking at it it’s probably making a unique request to a resource on a NextDNS subdomain and watching where the request comes from. Like pulling an image from (unique _string).check.nextdns.com. This requires nothing special on the client, it’s making a standard request, and as part of that it needs to do a DNS lookup.
If the source of the and your IP are similar then it’s likely the same network, otherwise it can correlate the source with known resolvers.
-
[email protected]replied to [email protected] last edited by
Put a record in DNS whose content differs from other servers'. When they look it up regularly, they get one answer. When they look it up with you, they get a special answer. Then the servers behind those records return the relevant answer.
-
[email protected]replied to [email protected] last edited by
The website requests an image or whatever from
27748626267848298474.example.com, where the number is unique for the visitor. To load the content the browser has to resolve the DNS for it, and the randomness ensures it won't be cached anywhere as it's just for you. So it queries its DNS server which queries your DNS provider which queries the website's DNS server. From there the website's DNS server can see where the request came from and the website can tell you where it came from and who it's associated with if known.Yes it absolutely can be used for fingerprinting. Everything can be used for fingerprinting, and we refuse to fix it because "but who thinks of the ad companies???".
