What Is NXDOMAIN?

What is NXDOMAIN? How does nxdomain affects my browsing? Explains the relationship between NXDOMAIN and DNS Hijacking.

A DNS server is used to translate a domain name into an IP address or vise versa. For example, when you type dnsknowledge.com in your web browser, an authoritative dns server translate a domain name such as dnsknowledge.com into an IP address such as 67.228.49.226. However, if you try dnsknowledgefoobarexamplefackdomain.com, you will get an error indicating non existing domain name.

Non-existent Internet Domain Names Definition

NXDOMAIN is nothing but non-existent Internet or Intranet domain name. If domain name is unable to resolved using the DNS, a condition called the NXDOMAIN occurred. In this example, try to find out an ip address for the domain called abcquq12examfooltest.com using the nslookup or host command line option:
nslookup abcquq12examfooltest.com
OR
host abcquq12examfooltest.com
Sample outputs:

Host abcquq12examfooltest.com not found: 3(NXDOMAIN)

Since domain name is the invalid domain, you got a NXDOMAIN response i.e an error message indicating that domain is either not registered or invalid.

DNS Hijacking And NXDOMAIN

A few ISPs such as Optimum Online, Comcast, Time Warner, Cox Communications, RCN, Rogers, Charter Communications, Verizon, Virgin Media, Frontier Communications, Bell Sympatico, Airtel, and many others started the bad practice of DNS hijacking on non-existent domain name for making money by displaying the internet advertisements. These ISP and/or advertiser may collect your personal data too. These ISPs DNS server sends a fake IP address for all the NXDOMAIN responses. In most cases your browser will connect to a fake IP address server which will display page with advertising, instead of a proper error message to you. In some cases it is possible to obtain sensitive information too.

When you search for a Web site (domain) that doesn’t exist, these ISPs will hijack your session (also called as Error Redirection service), and it will show suggestions for sites that are similar to what you entered with tons of advertisements. In most circumstances DNS Error Redirection cause problems for customers running various specialty programs (such as game servers) or services (such as corporate vpn client and servers).

Example: DNS Hijacking On Non-existent Domain Name (NXDOMAIN)

The domain name foobar.dnsknowledge.com or a web site http://foobar.dnsknowledge.com doesn’t exist. If you run query for such address most ISPs will hijack your session and display advertisements. A typical dns query will look like as follows using the nslookup command on MS-Windows or host command on Mac OS X/Unix/Linux computer:
nslookup foobar.dnsknowledge.com
OR
host foobar.dnsknowledge.com
Sample outputs:

foobar.dnsknowledge.com has address 92.242.132.8

As a result of this hijacking you will see the following page:

Fig.01: My ISP Has Hijacked Nxdomain Page (click to enlarge)

Example: Non-existent Domain Name (NXDOMAIN) Response

In this example, I’m using our corporate resolving DNS name servers i.e. I’m not using ISP’s dns server. This ensures that my DNS session can not be hijacked. A typical dns query will look like as follows using the nslookup command on MS-Windows or host command on Mac OS X/Unix/Linux computer:

nslookup foobar.dnsknowledge.com
OR
host foobar.dnsknowledge.com
Sample outputs:

Host foobar.dnsknowledge.com not found: 3(NXDOMAIN)

No ip address returned and I got clean error message. This suggest that the domain foobar.dnsknowledge.com doesn’t exists. I’ve disabled hijacking of NXDOMAIN responses using my own resolving caching dns server:

Fig.02: No DNS hijacking / DNS Redirection Example (click to enlarge)

Summary

1. NXDOMAIN error message means that a domain does not exist.
2. Some ISPs started DNS hijacking or DNS redirection for NXDOMAIN error messages.
3. It is the practice of redirecting the resolution of Domain Name System (DNS) names to other DNS servers or web servers.
4. Commonly used for displaying advertisements or collecting statistics.
5. This practice violates the RFC standard for DNS (NXDOMAIN) responses.
6. Phishing : Cross-site scripting attacks can occurred due to malicious hijacking.
7. Censorship : DNS service providers to block access to selected domains.

转自http://www.dnsknowledge.com/whatis/nxdomain-non-existent-domain-2/