Analysis: possible security issue using PUBLICIP_FETCHERS and RESOLVER_ADDRESS #290

New Issue

saavagebueno · 2025-11-20T04:22:22-05:00

saavagebueno commented

2025-11-20 04:22:22 -05:00

Originally created by @adripo on GitHub (Jun 16, 2023).

By using external DNS resolver option RESOLVER_ADDRESS combined with PUBLICIP_FETCHERS=dns could result in a possible security issue where a targeted attack can be performed, given the fact that DNS queries are not encrypted.
MITM and similar attacks can be performed in order to alter DNS queries and inject custom IP addressed to be updated for a specific domain.

Ref:
https://github.com/qdm12/ddns-updater/issues/389#issuecomment-1595175041

However, just for curiosity, wouldn't this be a security issue if used together with PUBLICIP_FETCHERS=dns? An attacker could change the answer for both public IP and DNS answer in a very specific and targeted attack in order to change the ip of my domain?

Originally created by @adripo on GitHub (Jun 16, 2023). By using external DNS resolver option `RESOLVER_ADDRESS` combined with `PUBLICIP_FETCHERS=dns` could result in a possible security issue where a targeted attack can be performed, given the fact that DNS queries are not encrypted. MITM and similar attacks can be performed in order to alter DNS queries and inject custom IP addressed to be updated for a specific domain. Ref: https://github.com/qdm12/ddns-updater/issues/389#issuecomment-1595175041 > However, just for curiosity, wouldn't this be a security issue if used together with [PUBLICIP_FETCHERS=dns](https://github.com/qdm12/ddns-updater/issues/136)? An attacker could change the answer for both public IP and DNS answer in a very specific and targeted attack in order to change the ip of my domain?

saavagebueno closed this issue

2025-11-20 04:22:22 -05:00

saavagebueno commented

2025-11-20 04:22:23 -05:00

@qdm12 commented on GitHub (Jun 17, 2023):

Fixed in 320d91d8e3

Now both Cloudflare and OpenDNS use DNS over TLS to communicate and echo the public ip address.
However, Google was removed since its public ip echo nameserver does not support DNS over TLS (wtf right?).
This is a bit of a breaking change, but it should be mitigated by:

the announcement at the top of your logs mentioning it is now removed
the warning logged if someone specifies google
google gets auto-magically removed from the list of dns providers if found, so the program should not error and crash.

@qdm12 commented on GitHub (Jun 17, 2023): Fixed in 320d91d8e3e3d7848e7559779a71715702449d5e Now both Cloudflare and OpenDNS use DNS over TLS to communicate and echo the public ip address. However, **Google** was removed since its public ip echo nameserver does not support DNS over TLS (wtf right?). This is a bit of a breaking change, but it should be mitigated by: - the announcement at the top of your logs mentioning it is now removed - the warning logged if someone specifies `google` - `google` gets auto-magically removed from the list of dns providers if found, so the program should not error and crash.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ddns-updater#290