3 ms·

I run the prepend.com domain. I don’t think there’s any way for you, or anyone without admin access to my dns server, to know when I add a CNAME record for tial

I run the prepend.com domain. I don’t think there’s any way for you, or anyone without admin access to my dns server, to know when I add a CNAME record for tialaramex.prepend.com. I guess someone could continuously request every possible entry over and over to see when I do that, but don’t think it’s likely.

tialaramex 5y ago
Passive DNS doesn't request every possible entry. What happens is that when say, somebody uses their AT&T phone to ask A? tialaramex.prepend.com the AT&T DNS servers tell them that's 10.20.30.40 and the AT&T DNS servers tell a passive DNS outfit, "At 18:26 UTC the answer to A? tialaramex.prepend.com was apparently 10.20.30.40" Now, I'm sure that lots of HN readers have a local manually configured DNS resolver that of course isn't feeding passive DNS. And some of them might even have an upstream DNS resolver which is bootstrapped and that too does not feed passive DNS. It's not even difficult if you were insistent upon doing it. But, the design guy's iPhone which he used to take a quick screenshot? Probably just uses a public DNS resolver. The woman who trains front line support and asked for a sneak peak ready to start training on the new site? She probably has 8.8.8.8 set as her DNS resolver. So just like asking for the publicly trusted certificate, this is another way that your DNS names go from "Nobody would guess what that is" to public knowledge in seconds once they leave your hands.