Blog | G5 Cyber Security

Detecting DNS Redirection by Your ISP

G5 Cyber Security

TL;DR

Yes, you can detect if your Internet Service Provider (ISP) is redirecting your DNS traffic. This guide shows you how using various tools and techniques, ranging from simple online tests to more advanced command-line checks.

How ISPs Redirect DNS Traffic

ISPs sometimes redirect DNS requests for a few reasons:

While not always malicious, it’s good to know if your ISP is doing this so you can understand what’s happening with your internet connection.

Detecting DNS Redirection

  1. Check Your Router Settings:
    • Log into your router’s admin panel (usually via a web browser – check your router’s manual for the address, often 192.168.1.1 or 192.168.0.1).
    • Look for DNS settings. If they are automatically assigned by DHCP and show your ISP’s servers, that’s a starting point. If you’ve manually set custom DNS servers (like Cloudflare or Google Public DNS) but still suspect redirection, proceed to the next steps.
  2. Use an Online DNS Leak Test:
    • Several websites can check which DNS servers your computer is actually using. Some popular options include:
    • Run the standard test and then the extended test. If the results show servers belonging to your ISP when you expect to see different ones, it indicates redirection.
  3. Use Command Line Tools (for more technical users):
    • Windows: Open Command Prompt and use nslookup. 
      nslookup google.com

      Examine the “Server” line in the output. If it shows your ISP’s DNS servers, that’s what you are using. Repeat with a different domain name to confirm consistency.

    • macOS/Linux: Open Terminal and use dig or nslookup. 
      dig google.com

      Look for the “SERVER” line in the ANSWER SECTION. Again, check if it matches your expected DNS servers.

    • Check with a specific DNS server: You can force a query to use a particular DNS server. 
      nslookup google.com 8.8.8.8

      (This forces the query to Google’s public DNS server). Compare this output to the standard nslookup result.

  4. Check Your Hosts File:
    • The hosts file can override DNS lookups. It’s unlikely, but worth checking.
      • Windows: Open C:WindowsSystem32driversetchosts in a text editor (as administrator).
      • macOS/Linux: Open /etc/hosts in a text editor (using sudo if necessary).
    • Look for any unexpected entries that might be redirecting domains. Comment out or remove any suspicious lines.
  5. Use Wireshark (Advanced):
    • Wireshark is a network packet analyzer. It allows you to capture and inspect DNS traffic directly.
      • Download and install Wireshark.
      • Start capturing traffic on your network interface.
      • Filter for DNS packets (dns in the filter box).
      • Examine the source and destination IP addresses of the DNS queries. If you see queries going to your ISP’s DNS servers even when you’ve configured different ones, it confirms redirection.

What to Do if You Detect Redirection

Exit mobile version