cybersecuritysecurity

DNS Sinkhole

dns-sinkholesecuritydns
Plain English

A DNS sinkhole is a phone book that deliberately gives the wrong number for bad sites. Devices asking for an ad or malware domain get nowhere.

Technical Definition

The resolver returns 0.0.0.0 (or NXDOMAIN) for listed domains and forwards the rest upstream.

  • Home: Pi-hole, AdGuard Home.
  • Enterprise: protective DNS, also used to cut off botnet command servers.
  • Clients must use it: hand it out via DHCP.
  • Bypassed by hard-coded DNS or DNS over HTTPS.

Source: Pi-hole docs; CompTIA Security+ SY0-701 Exam Objectives v6.0

DNS Sinkhole in practice

$ dig @127.0.0.1 doubleclick.net +short
0.0.0.0
In the Wild

Pi-hole in BNLC lesson 8.4 is a sinkhole. Security+ SY0-701 objective 4.5 covers DNS filtering.

← Back to Dictionary