Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS Toys (2022)

dns.toys

Post reply on HN
Print view View original

21–30 of 71 posts

Re: DNS Toys (2022)

#21

Post by jfreax »

Havoc wrote: post #16

How does this actually work? Finding it hard to believe someone bought domains for all combinations of those unit conversions

> How does this actually work? Finding it hard to believe someone bought domains for all combinations of those unit conversions

dns.toys runs a (custom) DNS resolver. The example dig commands are asking this resolver. They are not using your configured (public) resolver. The custom resolver can return whatever it wants depending on the request. You could also ask the resolver what the IP (A-record) of e.g. "google.com" is and it could answer with whatever it wants.

Therefore, they actually just use one domain: dns.toys.

Re: DNS Toys (2022)

#22

Post by Havoc »

maxmouchet wrote: post #17
Havoc wrote: post #16

How does this actually work? Finding it hard to believe someone bought domains for all combinations of those unit conversions

It works by querying a specific DNS resolver (dns.toys): dig +short TXT mumbai.weather @dns.google # NXDOMAIN dig +short TXT mumbai.weather @dns.toys "Mumbai (IN)" "30.90C (87.62F)" "45.90% hu." "clearsky_day" "15:30, Sun" "Mumbai (IN)" "28.10C (82.58F)" "56.00% hu." "fair_day" "17:30, Sun" ...

I see - thanks for explaining

Re: DNS Toys (2022)

#23

Post by robryk »

I'm surprised that they aren't also available in some subdomain of dns.toys (so that they would resolve without using a special name server).

Re: DNS Toys (2022)

#25

Post by kuon »

koito17 wrote: post #5

This reminds me of a neat little trick I used back then to "reliably" compute IP address of my machines for a dynamic DNS utility I wrote for myself. OpenDNS resolvers (such as resolver1.opendns.com) will resolve myip.opendns.com to your actual IP address. Whether you get A or AAAA records depends on your connection. Since the IP addresses for these resolvers tend to be anycast IPs, I also want to believe they are ma…

Google and akamai also has a DNS service.

    dig @ns1-1.akamaitech.net ANY whoami.akamai.net +short


    dig @ns1.google.com TXT o-o.myaddr.l.google.com +short

Re: DNS Toys (2022)

#27

Post by input_sh »

account-5 wrote: post #24

Can someone ELI5 for the idiot in the thread. I know it's for fun but I don't get it. Also how's it's working? I'm aware it's my ignorance.

You're essentially resolving non-existent domains through their custom DNS server. For example:

    dig 100USD-INR.fx @dns.toys
Translates into "resolve 100USD-INR.fx using dns.toys as a DNS server". They then return TXT records containing the actual answer. Since .fx is a non-existent domain, they're not impersonating anyone, and if you switch "@dns.toys" with say "@8.8.8.8", it wouldn't resolve to anything.

Re: DNS Toys (2022)

#28

Post by themoonisachees »

account-5 wrote: post #24

Can someone ELI5 for the idiot in the thread. I know it's for fun but I don't get it. Also how's it's working? I'm aware it's my ignorance.

The DNS protocol is just text over udp. When making a DNS request, your system will open a socket, write "google.com" in it and read for a response. The server, if it is properly configured as a DNS server, will reply with the appropriate DNS record, again as text. Google.com is a cname to some subdomain used for load balancing, so the server will simply reply "CNAME blabla.google.com" and may optionally also resolve blabla.google.com to save you the trouble of making another request.

The DNS protocol, defined in some RFC, says that I have to make a request a certain way, and that the server has to respond a certain way. One of these ways is that for top level domains that don't exist (for ex. .time is not a currently existing tld), the server is supposed to reply nxdomain, but in reality there is no technical measure stopping it from replying with anything it wants, such as the current time.

In fact, generally speaking, the expectation that the server operators will not fuck you over is the only thing preventing public (and indeed private) DNS operators from returning you bogus data. This is mitigated somewhat by HTTPS, but DNS records themselves are infinitely fakeable with no recourse.

Re: DNS Toys (2022)

#29

Post by sethammons »

account-5 wrote: post #24

Can someone ELI5 for the idiot in the thread. I know it's for fun but I don't get it. Also how's it's working? I'm aware it's my ignorance.

Sure, imagine a DNS server as a specialized type of web server, but it uses a different protocol over a different port. Just like you make requests to a web server using HTTP, you can interact with a DNS server using DNS protocols. Think of it like comparing how you might use telnet to simulate an HTTP or SMTP request; it's about communicating with a specific type of server over a specific set of rules. This server tends to do some computation before yielding its results, unlike most DNS records that you'd expect to be static.

Re: DNS Toys (2022)

#30

Post by quesera »

robryk wrote: post #23

I'm surprised that they aren't also available in some subdomain of dns.toys (so that they would resolve without using a special name server).

If you used default nameservers, you'd be introducing all the usual DNS complications, e.g. caching.
Post reply on HN