Skip to content
markreinmuth's profile

New Contributor

 • 

3 Messages

Tue, Aug 2, 2022 9:15 PM

Transparent DNS Interception?

Comcast Business appears to be enforcing SOA lookups on all DNS requests, regardless of chosen lookup server.

This has two impacts, one is much easier to work with than the other and has a smaller impact.  The other has a much bigger impact but is more difficult to diagnose.

Issue 1) I am preparing to move DNS service from one server to another.  Part of the process involves checking all public records i.e. the "live" records, against the soon-to-be live records on the destination name server.  I expect the results to be identical, but the problem is Comcast Business is redirecting all queries to the live name server, invalidating the tests. 

I ended up creating a record on the destination host that does not exist on the live name server, to make testing easier.  This is not the domain name I am trying to move, it was modified for these tests but is functionally identical.  For this query:

dig @mimi.ns.cloudflare.com existsoncloudflareonly.prichardpartners.com TXT

The answer should be:

; <<>> DiG 9.10.6 <<>> @mimi.ns.cloudflare.com existsoncloudflareonly.prichardpartners.com TXT; (3 servers found);; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58741;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1;; WARNING: recursion requested but not available;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 1232;; QUESTION SECTION:;existsoncloudflareonly.prichardpartners.com. IN	TXT;; ANSWER SECTION:existsoncloudflareonly.prichardpartners.com. 300 IN TXT	"This record not visible on ns10.dnsmadeeasy.com";; Query time: 124 msec;; SERVER: 173.245.58.203#53(173.245.58.203);; WHEN: Tue Aug 02 14:02:45 PDT 2022;; MSG SIZE  rcvd: 132

When run on any Comcast Business connection, the answer is:

; <<>> DiG 9.10.6 <<>> @mimi.ns.cloudflare.com existsoncloudflareonly.prichardpartners.com TXT; (3 servers found);; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48983;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 512;; QUESTION SECTION:;existsoncloudflareonly.prichardpartners.com. IN	TXT;; AUTHORITY SECTION:prichardpartners.com.	180	IN	SOA	ns10.dnsmadeeasy.com. dns.dnsmadeeasy.com. 2009010132 43200 3600 1209600 180;; Query time: 26 msec;; SERVER: 108.162.192.203#53(108.162.192.203);; WHEN: Tue Aug 02 14:00:11 PDT 2022;; MSG SIZE  rcvd: 129

I have tested from three networks not in the Comcast Business network (Linode, Hunter Communications fiber from EugNet, and a privacy vpn,) and all return the first result.  I have also tested from three completely separate networks all in the Eugene, Oregon area, and all are affected by this issue.  Each one has a unique Comcast Business account.  In one case I connected a machine directly to the Comcast Gateway, cleared dns caches, and ran the tests with identical results (i.e. not a firewall config issue.)

Issue 2 is that this SOA enforcement - or whatever transparent modifications are taking place - causes some domain lookups to fail, and if a dig with +trace is used, the message ";; BAD (HORIZONTAL) REFERRAL" will eventually show up.  However, I would prefer not to focus on this one as it primarily occurs when both name servers use the same IP as the apache host.  This causes major issues including many sites not loading at all if accessed - exclusively - from Comcast Business networks.

---

Please note my main name servers are 8.8.8.8 (Google public DNS) and 1.1.1.1 (Cloudflare public DNS.)  By using "dig @server" (from the basic query of "dig @server name type") these requests should bypass those two addresses and return results from the requested server.  Instead, Comcast Business is modifying these requests to return results from the SOA as indicated by the whois lookup for the domain.  I have tried using many other name servers with identical results - the interception is on port 53.  I have not tested udp vs tcp, or port 853 to a degree that I can assert anything right now.  Xfinity users do not appear to be affected.

This basic modification of DNS is causing harm to my own use, and the use of other business clients and their clients. 

I can provide many more examples but would prefer to use DMs with Comcast Business reps (just for additional examples, everything else can happen publicly.)  I welcome all additional info.

New Contributor

 • 

3 Messages

2 m ago

The dig answer sections got mangled in posting.  Correct result in plain text (not a code block) is:

existsoncloudflareonly.prichardpartners.com. 300 IN TXT "This record not visible on ns10.dnsmadeeasy.com"

The modified result omits the ANSWER section and just posts the AUTHORITY section:

prichardpartners.com. 180 IN SOA ns10.dnsmadeeasy.com. dns.dnsmadeeasy.com. 2009010132 43200 3600 1209600 180

New Contributor

 • 

3 Messages

2 m ago

Hello,

Is there another avenue for support?  When I logged into my comcast business account this is the main digital path of support I am seeing.  Now this post was forced as private and there's been no response for almost a week.

When I have called in the past for support a reset was forced on my gateway, which was not applicable to that situation, and not applicable to this situation.

Official Employee

 • 

27 Messages

Good afternoon! Thank you for reaching out to us here through our Xfinity Forums! We are glad to help work through these concerns with you. The original post had a bit of personal information that was made private for your security. However, I was able to read through that to gather what you need as far as support. Let's go ahead and move this to a direct message platform, so we can work through your account directly.

Here's the detailed steps to Direct Message us:
• Click "Sign In" if necessary
• Click the "Direct Message" icon (upper right corner of this page)
• Click the "New message" (pencil and paper) icon
• Type "Xfinity Support" in the to line and select "Xfinity Support" from the drop-down list
• Type your message in the text area near the bottom of the window
• Press Enter to send your message