DNS Toys (2022)

The DNS protocol is just text over udp. When making a DNS request, your system will open a socket, write "google.com" in it and read for a response. The server, if it is properly configured as a DNS server, will reply with the appropriate DNS record, again as text. Google.com is a cname to some subdomain used for load balancing, so the server will simply reply "CNAME blabla.google.com" and may optionally also resolve blabla.google.com to save you the trouble of making another request.

The DNS protocol, defined in some RFC, says that I have to make a request a certain way, and that the server has to respond a certain way. One of these ways is that for top level domains that don't exist (for ex. .time is not a currently existing tld), the server is supposed to reply nxdomain, but in reality there is no technical measure stopping it from replying with anything it wants, such as the current time.

In fact, generally speaking, the expectation that the server operators will not fuck you over is the only thing preventing public (and indeed private) DNS operators from returning you bogus data. This is mitigated somewhat by HTTPS, but DNS records themselves are infinitely fakeable with no recourse.

Sure, imagine a DNS server as a specialized type of web server, but it uses a different protocol over a different port. Just like you make requests to a web server using HTTP, you can interact with a DNS server using DNS protocols. Think of it like comparing how you might use telnet to simulate an HTTP or SMTP request; it's about communicating with a specific type of server over a specific set of rules. This server tends to do some computation before yielding its results, unlike most DNS records that you'd expect to be static.

You're essentially resolving non-existent domains through their custom DNS server. For example:

    dig 100USD-INR.fx @dns.toys

Imagine a site like news.ycombinator.com. The browser uses that name to lookup the IP from a specialized server. So for the domain it might have this saved:

A IP = ...1

AAAA IP = ...2

Where 'a' is the type of record. But there are other types of records:

TXT gender = 'male'

So there's a few assumptions here about DNS that are normally true:

1. People are using DNS as a switch board to other services.

2. The values in the switchboard are normally static.

With this setup they're doing something completely different because they're serving back changing values based on the domain. To do this you would need to write a custom DNS server (though the DNS protocol is quite simple.) The reasons this is a clever hack though are as follows:

1. DNS is one of the most widely used and supported protocols. All mainstream programming libraries support it. This includes numerous command-line tools already in operating system. By providing this as a service over DNS it provides an elegant way for command-line tools and libraries to access services with minimal dependencies.

2. It challenges the way the DNS system should be used by tipping the normal assumptions behind its use on its head (direct usage for information, dynamic content for values.) This makes it possible to use DNS directly as an application service rather than as a switch board operator for regular internet services.

3. DNS is so integral that a complex integration wouldn't be needed to add it to existing software. A DNS request is arguably more straight-forwards than a typical web API. Chances are this also has benefits for censorship resistance, too.

All in all a clever hack.

dns clients come preinstalled on virtually any os

Often passed through firewalls or effectively proxied through resolvers

For fun.

Google and akamai also has a DNS service.

    dig @ns1-1.akamaitech.net ANY whoami.akamai.net +short


    dig @ns1.google.com TXT o-o.myaddr.l.google.com +short

Very nice idea. Seems way simpler than the STUN protocol.

Oh interesting - those circumferences are actually closer than I assumed they would be!

You don't need to use dig. nslookup or host work also.

Surely Windows has some kind of DNS lookup tool!

Dog is cross platform and has some nice features, like json output.

https://dns.lookup.dog/

It works by querying a specific DNS resolver (dns.toys):

  dig +short TXT mumbai.weather @dns.google
  # NXDOMAIN
 
  dig +short TXT mumbai.weather @dns.toys  
  "Mumbai (IN)" "30.90C (87.62F)" "45.90% hu." "clearsky_day" "15:30, Sun"
  "Mumbai (IN)" "28.10C (82.58F)" "56.00% hu." "fair_day" "17:30, Sun"
  ...

How does this actually work? Finding it hard to believe someone bought domains for all combinations of those unit conversions

dns.toys runs a (custom) DNS resolver. The example dig commands are asking this resolver. They are not using your configured (public) resolver. The custom resolver can return whatever it wants depending on the request. You could also ask the resolver what the IP (A-record) of e.g. "google.com" is and it could answer with whatever it wants.

Therefore, they actually just use one domain: dns.toys.

If you used default nameservers, you'd be introducing all the usual DNS complications, e.g. caching.

Usually if a response is greater than 512 bytes the DNS server will renegotiate on TCP 53. Note some DNS servers might not do this, but every normal implementation does that I’m aware of.

DNS can switch to tcp for this reason

DNS is designed for caching. You can use DNS for anything that is public, idempotent, and immutable (or at least, slow-changing).

Thanks for sharing these absolute gems!