Jump to content

Getting websites available through DNS registers.

Recommended Posts


I've been wanting to start a blog, the hard way. I've rented out a VPS, got a domain name, and set up Apache, openssh, iptables, all that good stuff. Now, the web service is running (with my placeholder webpage) as intended and the site is reachable. Only thing is that it only worked right when I used the VPS's IP address. When I typed in the domain name, configured to point toward the URL, it would display the page in an frame, with the title cut out. It also doesn't give you your source, and gives you the fetched source instead:


</HEAD><FRAMESET border='0' ROWS='*,1'> <FRAME SRC='http://X.X.X.X'><FRAME SRC='blank.html'> </FRAMESET> </html>

I looked into it, and it turned out to be an issue with my current DNS register. I changed my name server to manage the registry, and changed the alias (no pointing) to my server's ip address. I've also game it a CNAME (www.mydomain.com redirecting to mydomain.com). After a while, the alias domain started to work, but my CNAME is still giving me issues (returns my site in a frame). Plus, HTTP requests to the server via the domain name wasn't was timely as SSH or ping requests were.

Anyway, I guess what I'm asking is how can I better manage my DNS registry. Knowing aliasing vs pointing was something thats nice to know, but I was wondering if there are other things I should know about.

Link to comment
Share on other sites

cnames are aliases for subdomains and such, but you should have an A record for the main Domain and IP. Make sure your hosts DNS has propagated(usually takes 24 hours in some cases), but the A record should be the IP for the main site itself. You can have more than one A record as well, like A x.x.x.x.x, www A x.x.x.x. and both will show the same domain name it mapped to the correct IP and using the correct name servers. Mail servers don't have to but usually have their own IP and use MX records but a sites A record can have an entry for domain.com www.domain.com and ftp.domain.com. cnames, are usually if you had a subdomain on the same domain, and then later changed that subdomain to its own IP for the same domain, you would then alias the new IP with a cname entry. Why they put you in an iframe, is possibly because something was still showing as parked or not setup yet, but you should contact the host, for help and check if they have their own wiki on setting up DNS. DNS can get confusing real fast if you're pointing records to the wrong IP's. On my own domains, my domain, www, and ftp have same IP, but shell has different IP, and mail and database servers, each have their own IP's and entries. Just depends on the host and their services. Check with your host first.

Link to comment
Share on other sites

Thanks. :)


When done setting up, also make sure there is no security misconfiguration in such a way, that someone can do a DNS Zone Transfer as well. That will let them basically see all of the domain records, and subdomain names if they weren't public, cname entries, etc. If you had like 20 domains on the one account with aliases and such, someone would be able to find all of them with a zone transfer. You can do these with nslookup, but nmap has an nse script that makes it even easier and just point and click if you use the zenmap gui. Security should definitely be considered when setting it up and check with your host what kinds of things they have in place to protect it. I have my own PHP script I use, for mapping a domain and shows me all publicly available records on a domain, from the a record, to ipv6 aaaa records, txt comments(don't put anything important in there that gives anything away like an email address or settings like advertising lan side IP's).

DNS has also been the new cookie jar kids been attacking lately, DoS'ing DNS directly vs DDoS attacks against the domain on port 80, so if make sure you have more than one name server for the domain in most instances. I'm not sure how DNSsec is setup, but thats also something to ask your host about, like round robin and redundancy. http://en.wikipedia.org/wiki/DNSSEC

Link to comment
Share on other sites

The people I got my domain from allows me to lock my domain, and I'm hoping that will disallow anyone from doing a zone transfer.

I'm also going to look into DNSSEC. Verisign says that my domain is signed.

Link to comment
Share on other sites

Locks keep them from being bought after the registration runs out, no one can transfer it to another host without you releasing it or buying it out from under you. Thats more a whois/site registrar thing. Zone transfers, are holes that let people see all the IP to Subdomains and records, a records, cnames, etc, if you don't have it disabled.

Link to comment
Share on other sites

I'm not running a DNS server, and those settings haven't been available to me as far as I know.

Where are you adding cname records if you can't add an A record then? You don't need to be the one running a DNS server if its the host who handles the name server but allows you to add records for DNS entries, then you need to set the main IP as the A record for the domain. As for DNSSEC, that should be on their end. One quick way to find out if Zone Transfers are enabled, or not locked down, try and run one from your local machine against your domain.

In windows, open a command prompt (with elevated privileges if needed depending on user but should work for every user):

Type nslookup and hit enter. This should drop you into a prompt for the nslookup command vs doing say "nslookup google.com" to get just the IP returned to you.

From within the nslookup prompt, you have some options. Type ? and hit enter to see them.

> ?
Commands:   (identifiers are shown in uppercase, [] means optional)
NAME            - print info about the host/domain NAME using default server
NAME1 NAME2     - as above, but use NAME2 as server
help or ?       - print info on common commands
set OPTION      - set an option
    all                 - print options, current server and host
    [no]debug           - print debugging information
    [no]d2              - print exhaustive debugging information
    [no]defname         - append domain name to each query
    [no]recurse         - ask for recursive answer to query
    [no]search          - use domain search list
    [no]vc              - always use a virtual circuit
    domain=NAME         - set default domain name to NAME
    srchlist=N1[/N2/.../N6] - set domain to N1 and search list to N1,N2, etc.
    root=NAME           - set root server to NAME
    retry=X             - set number of retries to X
    timeout=X           - set initial time-out interval to X seconds
    type=X              - set query type (ex. A,AAAA,A+AAAA,ANY,CNAME,MX,NS,PTR,SOA,SRV)
    querytype=X         - same as type
    class=X             - set query class (ex. IN (Internet), ANY)
    [no]msxfr           - use MS fast zone transfer
    ixfrver=X           - current version to use in IXFR transfer request
server NAME     - set default server to NAME, using current default server
lserver NAME    - set default server to NAME, using initial server
root            - set current default server to the root
ls [opt] DOMAIN [> FILE] - list addresses in DOMAIN (optional: output to FILE)
    -a          -  list canonical names and aliases
    -d          -  list all records
    -t TYPE     -  list records of the given RFC record type (ex. A,CNAME,MX,NS,PTR etc.)
view FILE           - sort an 'ls' output file and view it with pg
exit            - exit the program

Now type:

server yournameserverhere, ie: server ns.mydns.com (this can also be an IP address, like that of the domain you run itself)

Now type:

set type=any (and hit enter)

Now type:

ls -d yoursitename.com (and hit enter)

If you see records returned, its sending you a zone transfer. If you get something along the lines of :

"ls: connect: Result too large"

Then it may be possible to probe or even brute force with other tools for names, or if you get

*** Can't list domain yoursitename.com: Unspecified error

The DNS server refused to transfer the zone yoursitename.com to your computer. If this

is incorrect, check the zone transfer security settings for yoursitename.com on the DNS

server at IP address x.x.x.x.

Then most likely its refusing the zone transfer, which is a good thing.

There are other tools you can use in linux, (such as nslookup as well but check their help file, commands are bit diff), dig, and some backtrack scripts like dnsbrute, and nmap even has an nse script for automating the job for you although dns brute tools often work pretty well when others can fail.

Edited by digip
Link to comment
Share on other sites

Where are you adding cname records if you can't add an A record then?

I've been given access to my domain's records, but it's not my name server. My VPS provider just provides free DNS hosting. I'm able to add A, CNAME, MX, and other records.


I used nslookup like you said, and it's refusing zone transfers. :)

Edited by nvemb3r
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...