🔧 DNS Tools

🔍 dnsscience_snifferd

Real-Time DNS Traffic Monitoring Daemon

Deploy on client networks to capture and analyze ALL DNS queries in real-time. Automatically detects threats, blacklisted DNS servers, and suspicious traffic patterns.

Key Features:

• Real-time packet capture with scapy
• Threat detection via DNS Science API
• Blacklisted DNS server detection
• Multiple monitoring locations
• Web dashboard integration

Quick Start:

git clone https://github.com/dnsscience/dnsscience_snifferd.git
cd dnsscience_snifferd
sudo pip3 install -r requirements.txt
sudo python3 dnsscience_snifferd.py -c config.yaml

📊 dnsscience_analyze

PCAP Analysis Tool for Forensic Investigation

Offline analysis of DNS traffic from packet captures. Perfect for security incident investigation and historical traffic analysis.

Key Features:

• Parse PCAP files and extract DNS queries
• Detect malicious domains using threat intelligence
• Identify blacklisted DNS servers
• Beautiful terminal output with rich library
• Export results to JSON

Usage:

# Analyze a PCAP file
python3 dnsscience_analyze.py -c config.yaml capture.pcap

# Output includes:
# • Total packets and DNS queries
# • Unique domains and IPs
# • Threat detection summary
# • Query type breakdown
# • Top DNS servers used

🔌 DNS Monitoring API

REST API for Programmatic Access

Manage monitoring locations, retrieve threat data, and integrate DNS monitoring into your applications.

Endpoints:

• GET /api/v1/dns-monitoring/locations - List monitoring locations
• POST /api/v1/dns-monitoring/locations - Create new location
• POST /api/v1/dns-monitoring/queries - Ingest DNS queries
• GET /api/v1/dns-monitoring/threats - Retrieve detected threats
• GET /api/v1/dns-monitoring/stats - Get statistics

Example:

curl -X POST https://www.dnsscience.io/api/v1/dns-monitoring/locations \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"location_name": "Office HQ"}'

# Returns API key for dnsscience_snifferd deployment

🐍 DNS Science Unbound Module

Python-Powered DNS Security & Intelligence

Custom Unbound Python module that integrates DNS Science threat intelligence directly into your DNS resolver for real-time protection and analytics.

Key Features:

• Real-time threat intelligence integration
• Malware/phishing domain blocking
• DNS tunneling detection
• DGA (Domain Generation Algorithm) detection
• Policy-based filtering and rate limiting
• Query analytics and reporting
• Custom response generation

Architecture:

• Modular design with 6 sub-modules
• Threat Intelligence Module
• Policy Engine Module
• Analytics Collector Module
• Response Override Module
• Geo-Location Module
• DNS Firewall Module

🐳 Docker Deployment

Containerized DNS Resolver with DNS Science Integration

Pre-built Docker container with Unbound DNS resolver and DNS Science Python module pre-configured for immediate deployment.

Quick Start:

# Pull DNS Science Unbound container
docker pull dnsscience/unbound:latest

# Run with your API key
docker run -d \
  -p 53:53/udp \
  -p 53:53/tcp \
  -e DNSSCIENCE_API_KEY=your_key_here \
  --name dnsscience-resolver \
  dnsscience/unbound:latest

Configuration:

• Mount custom config: -v /path/to/config:/etc/unbound/dnsscience.conf
• Enable/disable modules via environment variables
• Volume for persistent cache and logs
• Health check endpoint included

🔌 Unbound API Endpoints

REST API for Unbound Module Management

Manage your Unbound resolvers, retrieve threat data, and configure policies via our specialized API endpoints.

Endpoints:

• POST /api/v1/unbound/register - Register new resolver instance
• POST /api/v1/unbound/query - Submit query for threat analysis
• POST /api/v1/unbound/analytics - Batch upload query statistics
• GET /api/v1/unbound/policy - Download latest policy rules
• POST /api/v1/unbound/alerts - Submit security alerts
• GET /api/v1/unbound/stats - Get resolver statistics

Example Registration:

curl -X POST https://www.dnsscience.io/api/v1/unbound/register \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "resolver_name": "Office DNS",
    "location": "HQ Data Center",
    "modules_enabled": [
      "threat_intel",
      "analytics",
      "policy"
    ]
  }'

# Returns resolver ID and module-specific API key