DNS poisoning?
|
View:
New views
5 Messages
—
Rating Filter:
Alert me
|
 |
DNS poisoning?
by Bill Stout
::
Rate this Message:
Hello,
I'm working through an intermittent incoming email bounce problem I hope someone can shed some light on. A few major companies are reporting intermittent bounces when sending email to us. Someone forwarded a bounce message which contained the following information: ... connect to mail.greenborder.com [216.52.7.214]: Connection timed out ... I do not have a host named 'mail.greenborder.com' in my DNS records. The IP address is not a mail server, it's an Internap address. http://www.dnsstuff.com/tools/whois.ch?ip=216.52.7.214 I tried to obtain help through the DNS experts at Network Solutions through Customer Support; their Customer Support guys are _absolutely clueless_ on how DNS works. They keep referring me to 'the provider who hosts my email service'. My MX records are here: http://www.dnsstuff.com/tools/lookup.ch?name=greenborder.com&type=MX (Temporarily modified for troubleshooting purposes) greenborder.com. MX IN 7200 USC1.MAILHOSTSXODE.NET. [Preference = 10] greenborder.com. MX IN 7200 MAILGATE.greenborder.com. [Preference = 1] greenborder.com. MX IN 7200 USP1.MAILHOSTSXODE.NET. [Preference = 5] greenborder.com. NS IN 7200 NS31.WORLDNIC.com. greenborder.com. NS IN 7200 NS32.WORLDNIC.com. MAILGATE.greenborder.com. A IN 7200 66.123.15.52 Any help would be appreciated. TIA, Bill Stout |
|
|
Re: DNS poisoning?
by fuzzyping
::
Rate this Message:
On Jan 26, 2007, at 10:23 PM, Bill Stout wrote:
> Hello, > > I'm working through an intermittent incoming email bounce problem I > hope > someone can shed some light on. A few major companies are reporting > intermittent bounces when sending email to us. > > Someone forwarded a bounce message which contained the following > information: > > ... connect to mail.greenborder.com [216.52.7.214]: Connection timed > out ... > > I do not have a host named 'mail.greenborder.com' in my DNS records. > The IP address is not a mail server, it's an Internap address. > http://www.dnsstuff.com/tools/whois.ch?ip=216.52.7.214 > > I tried to obtain help through the DNS experts at Network Solutions > through Customer Support; their Customer Support guys are _absolutely > clueless_ on how DNS works. They keep referring me to 'the > provider who > hosts my email service'. > > My MX records are here: > http://www.dnsstuff.com/tools/lookup.ch?name=greenborder.com&type=MX > (Temporarily modified for troubleshooting purposes) > > greenborder.com. MX IN 7200 USC1.MAILHOSTSXODE.NET. [Preference = 10] > greenborder.com. MX IN 7200 MAILGATE.greenborder.com. [Preference = 1] > greenborder.com. MX IN 7200 USP1.MAILHOSTSXODE.NET. [Preference = 5] > greenborder.com. NS IN 7200 NS31.WORLDNIC.com. > greenborder.com. NS IN 7200 NS32.WORLDNIC.com. > MAILGATE.greenborder.com. A IN 7200 66.123.15.52 > > Any help would be appreciated. Your records look fine on my end. Both ns31 and ns32.worldnic.com return the following MX records: greenborder.com. 7200 IN MX 5 USP1.MAILHOSTSXODE.NET. greenborder.com. 7200 IN MX 10 USC1.MAILHOSTSXODE.NET. greenborder.com. 7200 IN MX 15 MAILGATE.greenborder.com. You need to find out which resolvers are returning the bad records to your senders. HTH. -- Jason Dixon DixonGroup Consulting http://www.dixongroup.net |
|
|
Re: DNS poisoning?
by Hans-J. Ullrich
::
Rate this Message:
Am Samstag, 27. Januar 2007 04:23 schrieb Bill Stout:
> Hello, > > I'm working through an intermittent incoming email bounce problem I hope > someone can shed some light on. A few major companies are reporting > intermittent bounces when sending email to us. > > Someone forwarded a bounce message which contained the following > information: > > ... connect to mail.greenborder.com [216.52.7.214]: Connection timed > out ... > > I do not have a host named 'mail.greenborder.com' in my DNS records. > The IP address is not a mail server, it's an Internap address. > http://www.dnsstuff.com/tools/whois.ch?ip=216.52.7.214 > > I tried to obtain help through the DNS experts at Network Solutions > through Customer Support; their Customer Support guys are _absolutely > clueless_ on how DNS works. They keep referring me to 'the provider who > hosts my email service'. > > My MX records are here: > http://www.dnsstuff.com/tools/lookup.ch?name=greenborder.com&type=MX > (Temporarily modified for troubleshooting purposes) > > greenborder.com. MX IN 7200 USC1.MAILHOSTSXODE.NET. [Preference = 10] > greenborder.com. MX IN 7200 MAILGATE.greenborder.com. [Preference = 1] > greenborder.com. MX IN 7200 USP1.MAILHOSTSXODE.NET. [Preference = 5] > greenborder.com. NS IN 7200 NS31.WORLDNIC.com. > greenborder.com. NS IN 7200 NS32.WORLDNIC.com. > MAILGATE.greenborder.com. A IN 7200 66.123.15.52 > > Any help would be appreciated. > > TIA, > > Bill Stout Lokks like a spammer for me. Due to a mailserver is looking for a response from a DNS, a spammer redirects it to his own Client (from which he wants to spam). So tehere are to advantages: He can send with any address he wants to, and sometimes it is faster. Please correct me, if I am wrong. regards Hans |
|
|
Re: DNS poisoning?
by Francois Yang
::
Rate this Message:
I wonder how many of those messages the person who sent you the
original bounce received. I'm thinking what if they(spammer) sent out 1000s of messages with an invalid From server and invalid users. The receiving server would try to send the bounce message back 1000's of time and keep retrying. So it could be some kind of DOS against the person who sent you the original bounce message. just a thought. On 1/29/07, Hans-J. Ullrich <hans.ullrich@...> wrote: > Am Samstag, 27. Januar 2007 04:23 schrieb Bill Stout: > > Hello, > > > > I'm working through an intermittent incoming email bounce problem I hope > > someone can shed some light on. A few major companies are reporting > > intermittent bounces when sending email to us. > > > > Someone forwarded a bounce message which contained the following > > information: > > > > ... connect to mail.greenborder.com [216.52.7.214]: Connection timed > > out ... > > > > I do not have a host named 'mail.greenborder.com' in my DNS records. > > The IP address is not a mail server, it's an Internap address. > > http://www.dnsstuff.com/tools/whois.ch?ip=216.52.7.214 > > > > I tried to obtain help through the DNS experts at Network Solutions > > through Customer Support; their Customer Support guys are _absolutely > > clueless_ on how DNS works. They keep referring me to 'the provider who > > hosts my email service'. > > > > My MX records are here: > > http://www.dnsstuff.com/tools/lookup.ch?name=greenborder.com&type=MX > > (Temporarily modified for troubleshooting purposes) > > > > greenborder.com. MX IN 7200 USC1.MAILHOSTSXODE.NET. [Preference = 10] > > greenborder.com. MX IN 7200 MAILGATE.greenborder.com. [Preference = 1] > > greenborder.com. MX IN 7200 USP1.MAILHOSTSXODE.NET. [Preference = 5] > > greenborder.com. NS IN 7200 NS31.WORLDNIC.com. > > greenborder.com. NS IN 7200 NS32.WORLDNIC.com. > > MAILGATE.greenborder.com. A IN 7200 66.123.15.52 > > > > Any help would be appreciated. > > > > TIA, > > > > Bill Stout > > Lokks like a spammer for me. Due to a mailserver is looking for a response > from a DNS, a spammer redirects it to his own Client (from which he wants to > spam). So tehere are to advantages: He can send with any address he wants to, > and sometimes it is faster. > > Please correct me, if I am wrong. > > regards > > Hans > > |
|
|
RE: DNS poisoning? (Solved)
by Bill Stout
::
Rate this Message:
Hi guys,
Thanks for the feedback! I originally posted to Firewalls on Friday and didn't see activity over the weekend, so I posted to security-basics. Paul daSilva pointed me to the problem. $ whois internap.com [...] Domain servers in listed order: NS-A.PNAP.NET 64.94.123.4 NS-B.PNAP.NET 64.94.123.36 NS-C.PNAP.NET 64.95.61.4 NS-D.PNAP.NET 64.95.61.36 [...] $ nslookup > server 64.94.123.36 Default server: 64.94.123.36 Address: 64.94.123.36#53 > mail.greenborder.com Server: 64.94.123.36 Address: 64.94.123.36#53 Name: mail.greenborder.com Address: 216.52.7.214 The IP returned to the email client was also owned by Internap. Internap claimed to be authoritive for my domain, and even had a few fake records. I'm unsure why this happened, but this stopped after an email to their abuse and noc email addresses. Their DNS servers no longer return hostnames or claim authority. What I did manage to capture before the change was a set of false records: mail.greenborder.com False Address: 216.52.7.214 www.greenborder.com False Address: 216.52.7.212 ftp.greenborder.com False Address: 216.52.7.210 If this was malicious, the next question is how long, what login information did these systems capture, and what email may have been intercepted. I see the changes, but Internap has not replied to my email (dns problems? ;) ). Bill Stout GreenBorder -----Original Message----- From: listbounce@... [mailto:listbounce@...] On Behalf Of Bill Stout Sent: Friday, January 26, 2007 7:24 PM To: firewalls@... Subject: DNS poisoning? Hello, I'm working through an intermittent incoming email bounce problem I hope someone can shed some light on. A few major companies are reporting intermittent bounces when sending email to us. Someone forwarded a bounce message which contained the following information: ... connect to mail.greenborder.com [216.52.7.214]: Connection timed out ... I do not have a host named 'mail.greenborder.com' in my DNS records. The IP address is not a mail server, it's an Internap address. http://www.dnsstuff.com/tools/whois.ch?ip=216.52.7.214 I tried to obtain help through the DNS experts at Network Solutions through Customer Support; their Customer Support guys are _absolutely clueless_ on how DNS works. They keep referring me to 'the provider who hosts my email service'. My MX records are here: http://www.dnsstuff.com/tools/lookup.ch?name=greenborder.com&type=MX (Temporarily modified for troubleshooting purposes) greenborder.com. MX IN 7200 USC1.MAILHOSTSXODE.NET. [Preference = 10] greenborder.com. MX IN 7200 MAILGATE.greenborder.com. [Preference = 1] greenborder.com. MX IN 7200 USP1.MAILHOSTSXODE.NET. [Preference = 5] greenborder.com. NS IN 7200 NS31.WORLDNIC.com. greenborder.com. NS IN 7200 NS32.WORLDNIC.com. MAILGATE.greenborder.com. A IN 7200 66.123.15.52 Any help would be appreciated. TIA, Bill Stout |
| Free embeddable forum powered by Nabble | Forum Help |
