6 replies to this topic

[doogie88]

There is one website, forget which one, but you can do a whois on a site, and also view reverse DNS lookup, which shows all your sites on that IP address.
I have like 10 sites on the same IP address, and don't want people to be able to see all the sites I own if they find out one of them.
Is there any way to stop this?

Also I guess Nameservers also give this information away.

Edited by doogie88, 07 August 2008 - 11:03 PM.

[chrishirst]

http://www.domaintools.com/ used to be on whois.sc

Is there any way to stop this?

Nope.

Well you could delete the PTR records, but there's every chance that would mess up mail delivery to some hosts.

[doogie88]

http://www.domaintools.com/ used to be on whois.sc

Nope.

Well you could delete the PTR records, but there's every chance that would mess up mail delivery to some hosts.

Damn, that kinda sucks.
I have some private sites I try and keep off the radar, but this pretty much stops that.

[Randy]

Put 'em on their own IP number. That's how it works after all. rDNS doesn't tell you every site hosted on the same server. Just the same IP.

<edit to add>

Just in case anybody thinks to try these rDNS tools available out there to do some snooping on their competitors, realize first that because two sites sit on the same IP number doesn't mean they're owned/run by the same person. There is tons of shared hosting out there these days.

Also, do not place full and immediate trust in the returns you may get from some of these tools. Too many of them cache data and never double check what they tell you. A good for instance is Google.com. Using one of these tools (not the one Chris mentioned, I've never tested it) if I do a rDNS lookup on Google.com it gives back three IP numbers, showing that each IP number has multiple domains sitting on it. To the tune of some 1,800 or so domains supposedly sitting on the same IP number(s) as Google.com.

But if I do a manual, real time rDNS lookup via Dig to spot check some of those domains I couldn't find a single one of the dozen or so I checked that was actually hosted on the same IP number as Google.com. So a few grains of salt is definitely in order sometimes. FWIW, I get the same kind of shady results if I plug in one of my own server IP numbers where I can see exactly what domains are hosted on the IP number in question. Where the number of domains returned is usually somewhere in the right neighborhood, but not right. and the domains the tool tells me are hosted on my server are all wrong.

Be careful with those tools until you've proven to yourself you can trust it's output. It's easy to do with Dig or even nslookup if you have a few spare moments.

Edited by Randy, 08 August 2008 - 09:20 PM.

[1dmf]

Randy,

I have over 30 domains on one box (same IP) , yet an rDNS doesn't show a single domain being hosted but a competely different domain all together.

This was done using nslookup , so why do none of my sites show up?

One would also have to summise that the answer to this

Is there any way to stop this?

is YES! , dunno how but none of my sites show up for reverse lookup, so something somewhere is configured to return only one domain

gw-nodns.domainname.com

[Randy]

Technically speaking normal nslookup's (nor dig for that matter) are going to truly do an rDNS lookup. All it's going to tell you is the IP number a site sits on, according to its A records.

As Chris mentioned above, true rDNS has to do with PTR records, not A records. So an rDNS lookup involves querying a server to get it to give up all of its PTR records for a given IP number. In the Linux world one does this with a dig command like dig -x 10.10.0.1 where the last part is the ip number a site actually sits on.

But I'll warn you this isn't nearly as perfect as one would think it might be. Many (most?) shared hosting servers do not in fact have PTR records set up for each and every domain it houses. Even my own servers don't have PTR records set up for each domain I host.

[akaplan]

>>
But I'll warn you this isn't nearly as perfect as one would think it might be. Many (most?) shared hosting servers do not in fact have PTR records set up for each and every domain it houses. Even my own servers don't have PTR records set up for each domain I host.
>>

Sure there's no real reason to spend the time setting a .ptr record for a website. Using linux you can also try "whois ip.ad.dr.es" (where ip.ad.dr.es equals the ip you wish to query )to see who owns/controls the ip address.

.PTR records are important for outgoing mail servers. To verify the owner of the mailserver and prevent the mail server pretending to be a different mail server.