Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I think my ISP is intercepting NXDOMAIN requests. For instance, I type into my address bar, and I am redirected to instead.

I have set my Primary DNS address to Google Public DNS (, but am still getting forwarded.

How can I test to be sure that I am correct?

What can I do?

share|improve this question
up vote 1 down vote accepted

I assume you tested with a Web browser. Not a good idea because there are many functions in the typical browser which can interfere with the detection of a lying DNS resolver.

You did not indicate which operating system you use. Assuming Unix, you probably have dig installed. Test:

dig A

should bring back a NXDOMAIN, depending on the setup of your default DNS resolver.

dig @ A

should bring also NXDOMAIN and allow you to test if your access provider transparently redirects DNS requests (it should go to Google DNS).

share|improve this answer

First things first, to rule out redirecting malware, if you have any other internet capable device, change it to the same DNS provider and see if you get the same results.

If you don't, you probably have malware on your pc. If you do get the same results, it is either the DNS provider or your ISP.

I have no experience with Google Public DNS as I haven't had time to mess around with it, but if you set your dns server to Opendns just for a moment and see if you get redirected to their service or that address you posted originally.

If with OpenDNS you still get redirected to your one it is likely that your ISP is redirecting people.

If you go to the OpenDNS failure page, it is probably the current DNS provider that was forwarding you to there.

Edit -

And to answer your question...

The above is how to test if it is your ISP, Malware or your DNS provider.

As for what to do, if it is your DNS provider - Switch, if it is Malware - Fix/remove it, if it is your ISP - switch!

share|improve this answer
+1, I also make sure to call the ISP and complain about NXDOMAIN interception. – phoebus Dec 3 '09 at 19:29

When I encountered issues with this, I setup Bind to run locally within my home network. A nice feature of this it allowed me to have an authoritative server for all my internal IP addresses that doesn't require that I update /etc/hosts files on all my systems. Another benefit is having a caching DNS server within my home network.

I setup the main TLDs to be "type delegation-only" to avoid the DNS hijacking.

Link explaining the ISC Bind feature -

share|improve this answer
(Kind-of) fixed link: – Lucas Jones Jan 18 '12 at 21:00

Some operating systems, i.e., Microsoft Windows, maintain a DNS cache to speed up browsing. You may need to flush the cache when you change the DNS IP address(es) in your network configuration, or you may be redirected to a previously-seen ad page even after you've changed the DNS server addresses. Most 'nix systems (Unix, Linux, etc.) don't have a DNS cache, although there may be exceptions.

share|improve this answer

I would absolutely love it if Google Public DNS or OpenDNS would accept queries on a port other than 53. That will be the end of this nonsense.

Until then, try piping your DNS queries over TOR - pretty high latency though.

If you have a bandwidth-rich friend without a boneheaded ISP, you can ask them to run a DNS forwarder on some other port and use them as a DNS server.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .