DNS-Sinkhole Injection

[HeinzP]

The DNS sinkhole option works perfectly well with a Microsoft DNS environment. Unfortunately, it fails if you try to perform DNS-sinkhole injection in front of a BIND DNS server running on Red Hat Linux. Requests to malicious domains simply time out:

Test-Domain from PaloAlto (works fine):
nslookup -query=cname test-c2.testpanw.com
test-c2.testpanw.com canonical name = sinkhole.paloaltonetworks.com

Malicious-Domain (should display the sinkhole cname instead of a timeout):
nslookup -query=cname apleona.co
DNS request timed out

Has anyone else experienced anything similar?

[TomYoung]

Hi @HeinzP ,

Here is a related discussion.  https://www.reddit.com/r/dns/comments/p6g2lq/cant_resolve_some_sites_using_our_internal/

That person also had the same issue.  Unless someone else posts the solution, you will need to open a TAC case.  At least my response will put this thread on the top of the queue so others may see it. 😊

Thanks,

Tom