How my DNS browser fingerprinting works

The idea is that different browsers fetch DNS records differently. But in order to capture all DNS traffic we have to avoid DNS caching!! To solve that we generate a new subdomain for every request, so it’s impossible to cache.

Say our domain is example.com, if we generate 12 random digits (the longer the random number the less likely you are to hit collisions), using something like base36. We can generate random IDs like 2eg2mpkwgylh or zokydwitx5pu and then we just append our domain, and we have unique DNS records.

We just have to implement a DNS server where we serve the same A/AAAA/HTTPS record for anything .example.com

Implementing this into a normal website

All you have to do is add a script that will generate the random ID and fetch it. You can also make the returned A/AAAA/HTTPS record lead to a HTTP server that will just serve 200 if you dont want the fetch to fail.

I’m ignoring all the backend systems work you’d have to do to integrate the DNS server with the rest of your stack. But that’s different for everyone so you’ll have to figure it out.

Implementing this into a demo site

My plan is to have a demo website with a script that will query a rest API on a randomly generated domain like mentioned above. Then the API can check the host header to return the result of the DNS queries which can then be displayed in the demo site.

What I have done so far

• Implemented DNS server
• Implemented HTTP rest api
• Implemented some frontend demo code

What I need to do

• DNS fingerprinting algorithm itself
• Way for rest api to retrieve results
• Rest of demo frontend code