DNS sinkhole

This article needs additional citations for verification. Please help by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources:  –  ·  ·  · scholar · JSTOR (November 2021) (Learn how and when to remove this template message)

A DNS sinkhole, also known as a sinkhole server, Internet sinkhole, or Blackhole DNS^[1] is a DNS server that has been configured to hand out non-routable addresses for a certain set of domain names. Computers that use the sinkhole fail to access the real site.^[2] The higher up the DNS resolution chain the sinkhole is, the more requests will fail, because of the greater number of lower NS servers that in turn serve a greater number of clients. Some of the larger botnets have been made unusable by TLD sinkholes that span the entire Internet.^[3] DNS Sinkholes are effective at detecting and blocking bots and other malicious traffic.

By default, the local hosts file on a computer is checked before DNS servers, and can be used to block sites in the same way.

Applications[]

Sinkholes can be used both constructively, to contain threats such as WannaCry and Avalanche,^[4] and destructively, for example disrupting DNS services in a DoS attack.^{[clarification needed]}

One use is to stop botnets, by interrupting the DNS names the botnet is programmed to use for coordination. Another use is to block ad serving sites, either using a hosts file-based sinkhole^[5] or by locally running a DNS server (e.g., using a Pi-hole). Local DNS servers effectively block ads for all devices on the network.^[6]

References[]

This Internet domain name article is a stub. You can help Wikipedia by .

• v
• t