Introducing SOC Insights for BloxOne Threat Defense: Boost your SOC efficiency with AI-driven insights to eliminate manual work and accelerate investigation and response times. Read the blog announcement here.

NIOS DNS DHCP IPAM

Querying to nonexist domain, but get noerror respond

Posts: 105

‎07-07-2020 01:16 AM

1495

Hi,

I get some first experience finding when i try to query a non-existent domain the auth DNS response with no-error. below the capture dig response sample: (abc.co.id as example)

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6_10.7 <<>> A +additional asdf.abc.co.id. @8.8.4.4
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21196
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;asdf.abc.co.id. IN A

;; AUTHORITY SECTION:
abc.co.id. 1799 IN SOA ns1.abc.net. postmaster.no.email.please. 399010820 3600 600 2592000 3600

;; Query time: 579 msec
;; SERVER: 8.8.4.4#53(8.8.4.4)
;; WHEN: Tue Jul 7 10:10:53 2020
;; MSG SIZE rcvd: 127

Does anybody have explanation on this?

Thanks