search

TechnitiumSoftware / DnsServer

Technitium DNS Server
https://technitium.com/dns/
GNU General Public License v3.0
3.86k stars 401 forks source link

False Positive for custom blacklist entry? #771

Closed brokoler closed 8 months ago

brokoler commented 8 months ago

Hello,

I'm currently hardening my Apple Devices via whitelisting only specific domains. For this I added following entry to the Custom Blocked List: *.apple.com

It mostly does what I want to achieve, but recently I found an entry which should not be blocked in my point of view: gsp-ssl.ls-apple.com.akadns.net

For some reason it is recognizing "ls-apple.com" as an "apple.com" domain, but this should not be the case since the asterisk is written in front of the punctuation per my rule. Domains should only be blocked if they are ending on .apple.com It seems like Technitium does set the asterisk after the first punctuation and blocks any domain with any text before apple.com.

This domain should not be blocked in my point of view, is this a false positive?

From the logs: grafik

Help would be appreciated.

brokoler commented 8 months ago

Found the issue, the entry was blocked because it answered with following domain: gspx-ssl.ls.apple.com

Technitium handles everything as it should, for sure! :)

ShreyasZare commented 8 months ago

Thanks for the post. Good to know that its not an issue. The DNS server also inspects CNAME records in answer and will block them too which is probably what is happening here.