DNS Hijacking Monitoring - CNAME Monitoring

Monitoring Background

Current CDN technology is already very mature. In situations of high traffic and high concurrency, many customers need to use CDN. If customers want to monitor whether their website is hijacked to other hosts (DNS hijacking), according to the previous Network hijacking detection function, all host IPs need to be filled into the IP whitelist. However, CDN hosts may be very numerous, some up to over a thousand. It is very troublesome for customers to fill them in, and the storage limit reserved for IP whitelists in our database is around 2000 characters, so IPs may not all fit in.

Monitoring Principle

To meet customer requirements, Network products have launched a new hijacking monitoring function: CNAME Hijacking Monitoring. The principle is to perform DNS hijacking monitoring through the CNAME resolved during monitoring task execution. CNAME cannot be hijacked. As long as the CNAME is correct, the resolved IP must be correct. If the CNAME is incorrect, it is determined as hijacking. Currently, this function is first supported by PC nodes.

DNS Hijacking Monitoring - CNAME Monitoring

Monitoring Background#

Monitoring Principle#

Monitoring Background

Monitoring Principle