5 ms·

I'm having the same issue. https://securitytrails.com/ https://securitytrails.com/ also had my "secret" staging subdomain. I made a catch-all certificate, so

I'm having the same issue. https://securitytrails.com/ https://securitytrails.com/ also had my "secret" staging subdomain. I made a catch-all certificate, so the subdomain didn't show up in CT logs. It's still a secret to me how my subdomain ended up in their database.

selcuka 2y ago
They could be purchasing DNS query logs from ISPs.
arccy 2y ago
maybe your server responded to a plain ip addressed request with the real name...
- fc417fc802 2y ago
  He said he used a wildcard cert though. So what part of the response would contain the subdomain in that case?
- averageRoyalty 2y ago
  Host header is a request header, not a response one, isn't it?
johnklos 2y ago
Serious question: Do you really think that Cloudflare is trying to keep these kinds of thing private? If so, I'd suggest that's not a reasonable expectation.
- fc417fc802 2y ago
  Related question (not rhetorical). If you do DNS for subdomains yourself (and just use Cloudflare to point dns.example.com at your box) will the subdomain queries leak and show up in aggregate datasets? What I'm asking is if query recursion is always handled locally or if any of the reasonably common software stacks resolve it remotely.
  - immibis 2y ago
    As well as assuming Cloudflare sells DNS lists, it's probably safe to assume the operators of public resolvers like 8.8.8.8, 9.9.9.9 and 1.1.1.1 (that is Google, Quad9 and Cloudflare again) are looking at their logs and either selling them or using them internally.
  - johnklos 2y ago
    If you just use Cloudflare as a registrar, then they can't see what resolution happens on your servers. If you delegate a subdomain through Cloudflare to your own DNS servers, from what I remember from the animal book, the recursive server should ask Cloudflare for the address of the machine to which the delegation has been made (yours), and while any further resolutions would be answered by your machine, Cloudflare would at very least know of every query to that subdomain. If you delegate a subdomain and have subdomains under that subdomain, then Cloudflare would only see resolutions to that subdomain and not to the sub-subdomains. In other words, for most things, they'd have full insight.

selcuka 2y ago

They could be purchasing DNS query logs from ISPs.

arccy 2y ago

maybe your server responded to a plain ip addressed request with the real name...

fc417fc802 2y ago
He said he used a wildcard cert though. So what part of the response would contain the subdomain in that case?
averageRoyalty 2y ago
Host header is a request header, not a response one, isn't it?

johnklos 2y ago

Serious question: Do you really think that Cloudflare is trying to keep these kinds of thing private? If so, I'd suggest that's not a reasonable expectation.

fc417fc802 2y ago
Related question (not rhetorical). If you do DNS for subdomains yourself (and just use Cloudflare to point dns.example.com at your box) will the subdomain queries leak and show up in aggregate datasets? What I'm asking is if query recursion is always handled locally or if any of the reasonably common software stacks resolve it remotely.
- immibis 2y ago
  As well as assuming Cloudflare sells DNS lists, it's probably safe to assume the operators of public resolvers like 8.8.8.8, 9.9.9.9 and 1.1.1.1 (that is Google, Quad9 and Cloudflare again) are looking at their logs and either selling them or using them internally.
- johnklos 2y ago
  If you just use Cloudflare as a registrar, then they can't see what resolution happens on your servers. If you delegate a subdomain through Cloudflare to your own DNS servers, from what I remember from the animal book, the recursive server should ask Cloudflare for the address of the machine to which the delegation has been made (yours), and while any further resolutions would be answered by your machine, Cloudflare would at very least know of every query to that subdomain. If you delegate a subdomain and have subdomains under that subdomain, then Cloudflare would only see resolutions to that subdomain and not to the sub-subdomains. In other words, for most things, they'd have full insight.