Networks

Ask something
Discussion Locked

Mysterious DNS change

0 helpful
3 replies

by lb63640

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We recently had an odd experience with our W2K server/sp4 that serves as our DC and Exchange server.

All of a sudden, after an ISP rep visited our office to verify the block of IP addresses we were assigned, email to domains outside our own started getting logjammed in the SMTP queue. Incoming mail from any domain was fine.

It turns out that our primary and secondary DNS entries were changed to something else. When this was discovered and changed back to the appropriate entry, all was well.

How can this happen, and how can we prevent from it repeating? All users at that location swear they never go near the server, let alone touch it. The ISP rep says he did nothing. I know that neither myself nor my supervisor made a change...so I'm scratching my head.

Any input appreciated!

3 replies

by cg it

well sounds like someone changed something. If the server isn't in an equipment room might think about getting a lockable enclosure.

by hozcanhan

there are DNS configurations forwarding , broadcasting etc....also configurations whenever a DNS failure occurs . Did you look over those ? may be noone touched nothing , your preconfiguration may forced such a change ..

by asy

Well, preventing this it's quite easy. Just asign the real DNS number. It won't change. The thing that caused your problem was a exploit, and i have just one question, anyone on that terminal, or any other in the network, would admit he WAS watching porn?. Because we sure know he was not looking for cracks. If you want some more information or an explanation of how the exploit works, please post it.

This discussion is closed to new replies.