0

I understand that a DNS query packet between a DNS client and a DNS recursive resolver contains the client's IP address and MAC address.

When the recursive resolver in turn queries the authoritative name servers, which of the following things happens?

  1. Each DNS query packet, from the recursive resolver to each authoritative DNS server, includes (e.g. to aid in identifying the packets and their purpose) the same IP address and/or MAC address as were present in the query that the recursive resolver received from the original client; and the recursive resolver's IP address and/or MAC address are added to the packet to ensure that the response can be routed to the recursive resolver. I.e. the authoritative servers would potentially be able to determine, from the query, the IP address and/or MAC address of the computer from which the recursive resolver received the original query.

  2. Each DNS query packet, from the recursive resolver to each authoritative DNS server, does not include the IP address or MAC address as were present in the query that the recursive resolver received from the original client. The recursive resolver's IP address and/or MAC address are included in the packet to ensure that the response can be routed to the recursive resolver. I.e. the authoritative servers would not be able to determine, from the query, the IP address and/or MAC address of the computer from which the recursive resolver received the original query.

  3. Something else. If so, what?

I would be grateful if you could cite the sources for your answer(s).

4
  • 1
    Your premise is false. DNS query packets do not contain the client's MAC address. They may not contain any MAC address at all, but if they do, it will be the MAC address of the device that put that packet onto the DNS server's network. Oct 14, 2016 at 17:14
  • @DavidSchwartz, thanks. Did I use the relevant terminology incorrectly? I took my cue from the article I linked which says, "let's check out what a packet containing a DNS query would look like on our network" and shows a screengrab of a listing containing several fields including "MAC source addr" and "MAC dest. addr". The article also includes a diagram titled "DNS Packet - Ethernet II Frame", which includes "MAC Header" and "IP Header" sections. Did I interpret the article incorrectly?
    – user11574
    Oct 14, 2016 at 17:49
  • Not quite. The "MAC source addr" is the source address of that Ethernet packet. It's not part of the IP packet and so doesn't necessarily have anything to do with the MAC address of the source of the IP packet. Think of the IP packet like a letter and the Ethernet packet like an envelope. The same letter can move from envelope to envelope as it traverses the Internet. It can even travel without an envelope. It's the letter that gets to the destination. Varying envelopes are needed as it traverses various networks that require them in different ways. Oct 14, 2016 at 17:55
  • Many modern recursive resolvers do reveal most of the client IP address, via the EDNS Client Subnet extension. Google's and Cloudflare's public DNS services reportedly reveal 24 bits of an IPv4 address, and many others probably do the same, based on the suggestion in the RFC.
    – ʇsәɹoɈ
    Sep 30, 2019 at 22:52

1 Answer 1

0

DNS uses UDP and TCP, which are both on top of IP.

A connection, or an exchange between two DNS servers is defined by a 4 members tuple: source IP address, source port, destination IP address, destination port (mostly hardcoded to 53 for the DNS).

MAC address, being "below" IP have nothing to do here, as already explained in comments.

So each authoritative nameserver will see, at the network level, only the source IP/port of the recursive nameserver that asks the question.

Now:

  1. the recursive nameserver could run on an end host, so, without any kind of forwarding, in this case, the source IP seen by all authoritative nameservers will be the end client one
  2. sometimes the content of the query is also revealing, as much as the source IP. See the new standard on QNAME minimization: RFC7816 With it, each nameserver gets only the labels it needs to reply, not the whole name.
  3. some recursive nameservers can use the EDNS Client Subnet (ECS) extension, see RFC7871. With it the recursive nameserver will send "part" of the end client source IP together with the query to the authoritative nameserver. The idea is to help in CDN and geolocation so that load/geo balanced resources will be given to end client as an IP close to him and not necessarily close to the recursive nameserver. The recursive nameserver must be explicitely configured to send it (and choose the size of the mask, by default often /24) and the authoritative nameservers must be configured to use this information

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy