topic DNS Sinkholing subdomains of known bad domains in Advanced Threat Prevention Discussions

DNS Sinkholing subdomains of known bad domains

grumpycat — Tue, 23 May 2017 19:28:47 GMT

I tried to find an answer for this, but I couldn't find it. If someone has already posted this question, apologies...

I just turned DNS sinkholing and it works as expected for root domains, for example:

nslookup kntsv.nl returns the DNS sinkhole IP of 71.19.152.112.

BUT...

If I do an nslookup of any subdomain of kntsv.nl, it returns a valid A record, for example:

nslookup testing.kntsv.nl returns the IP of 109.72.85.37.

My question... Why did the dns lookup for the subdomain work but not the root? I would think the Palo would mark *.kntsv.nl as malicious and return with the sinkhole IP.

Thanks in advance for the help.

Re: DNS Sinkholing subdomains of known bad domains

Remo — Sat, 27 May 2017 10:28:30 GMT

When a root domain is malicious, it does not mean that automatically all subdomains are malicious.
As far as I know in the DNS signatures there are only FQDN's and not wildcard entries.

Re: DNS Sinkholing subdomains of known bad domains

murphyj — Thu, 08 Jun 2017 18:38:08 GMT

FYI, You should be able to create your own External Dynamic block list and add it to your DNS Sinkhole policy and wildcard the sub-domains if you want.