How to use HTTP probes to monitor carrier DNS hijacking-Cloud Monitor(CMS)-阿里云帮助中心

Carrier DNS hijacking changes the mapping between a domain name and an IP address on a carrier's DNS device. This causes the domain name to resolve to an incorrect IP address. You can use HTTP probes in Site Monitoring to monitor for DNS hijacking. You will receive an alert notification if a hijacking event occurs.

Prerequisites

Make sure that you have activated Network Analysis and Monitoring. For more information, see Activate Network Analysis and Monitoring.
Make sure that you have created an alert contact and an alert contact group. For more information, see Create an alert contact or an alert contact group.

Background information

A carrier's Local DNS (LDNS) is the first DNS service that end-user devices access. When the carrier's LDNS receives a domain name resolution request from an end-user device, it sends iterative queries to multiple levels of authoritative DNS servers. It then returns the final query result to the end-user device. The following figure shows a normal DNS resolution flow.

image..png

Note

www.example.com A indicates a query for the A record of www.example.com.

If a hijacking configuration for a specific domain name, such as www.example.com, exists on the carrier's LDNS, the LDNS does not use the response from the authoritative DNS server. Instead, when it receives a resolution request for that domain name, it returns the result from the hijacking configuration. This result is usually 127.0.0.1 or 0.0.0.0. The following figure shows the DNS resolution flow after hijacking.

image..png

Procedure

Log on to the Cloud Monitor console.
In the left-side navigation pane, choose Network Analysis and Monitoring > Site Monitoring.
On the Monitoring Tasks tab, click Create Task and then click Single-step Detection.
On the Create Task page, configure the parameters for the probe task.
- Basic Information: Set Task Type to HTTP(S), enter http_dns_task for Task Name, and enter www.example.com for Monitored Address.
  
  On the DNS Server tab of the Advanced Settings section, set DNS Server to Carrier DNS of Detection Point.
  
  Note
  If the IP address resolved from the monitored domain name does not match any IP address in the DNS Hijacking Whitelist, the domain name is considered hijacked. The domain name is also considered hijacked if its A record is not resolved using www.taobao.com.danuoyi.XXXXX.com.
  
  On the DNS Hijacking Check tab of the Advanced Settings section, configure the hijacking detection rule for the carrier's DNS server. Use the default values for other parameters.
  
  Note
  You can configure up to two hijacking detection rules for the carrier's DNS server, one for your domain name and one for a redirect domain name. If your domain name is configured with a CNAME record, configure a rule to match the domain name to its CNAME, for example, www.example.com:www.example.cname.com. If your domain name is configured with an A record, configure a rule to match the domain name to its IP addresses, for example, www.example.com:172.16.XX.XX|172.17.XX.XX|172.18.XX.XX. Configure the specific detection rules based on your DNS configuration.
- Select Detection Points: Select the detection points for the desired carrier. Use the default values for other parameters.
- Configure Alerts: Cloud Monitor provides a default alert rule for availability. Network jitter and low carrier DNS availability can cause frequent availability glitches. To prevent an alert storm, set the availability threshold to a suitable value. You must also create an alert rule for carrier DNS hijacking to receive prompt notifications when an alert is triggered. The steps are as follows:
  1. In the Configure Alert Rule section, click Add Rule.
  2. In the Add Rule panel, for Rule Name, enter Carrier DNS Hijacking, for Metric Name, select Number Of DNS Hijacking Detection Points, for Alert Level, select Critical, and for Threshold, enter 1.
- Configure Alert Contact Group: Select an alert contact group.
Click Create.