DNS Hijacking Monitoring - CNAME Monitoring

Monitor background

The current CDN technology is very mature. In the case of large traffic and high concurrency, many customers need to use CDN. If a customer wants to monitor whether their website is hijacked to other hosts (DNS hijacking), according to the previous Network hijacking detection function, all host IPs need to be filled in the IP whitelist. However, CDNs may have many hosts, some with more than a thousand hosts. It is very troublesome for customers to fill it out, and the storage limit reserved for the IP whitelist in our database is about 2,000 words, so all IPs may not be able to be written in.

Monitoring principle

In order to meet customer needs, Network products have launched a new hijacking monitoring function: CNAME hijacking monitoring. The principle is to monitor DNS hijacking by monitoring the CNAME parsed during task execution. The CNAME will not be hijacked. As long as the CNAME is correct, the IP parsed back must be correct. If the CNAME is incorrect, it is considered a hijack. Currently, this function is first supported by PC nodes.

DNS Hijacking Monitoring - CNAME Monitoring

Monitor background#

Monitoring principle#

Monitor background

Monitoring principle