Hey everyone, I've been following the discussions here about DNS exfiltration and I finally tried building my own canary domain setup over the weekend! I'm still pretty new to this whole DNS security layer, so I wanted to share what I did and ask a few questions to make sure I'm on the right track.

The basic idea I had was to set up a domain that should never receive any legitimate queries from my network. I registered a random, nonsensical domain (something like `x7f9b2p0v3q.monitor`) and pointed its NS records to a dedicated logging server I spun up with a tiny Python script using the `dnslib` library. This server just logs every single query it receives with a timestamp, source IP, and the query type.

I then added a static DNS entry on my internal Pi-hole server to resolve that canary domain to the IP of my logging server, so any device on my network would be directed there if something tried to look it up. My thinking is, if I ever see a log entry appear, it means something on my network is making a DNS request to a domain that has no business being queried, which could be a sign of malware or a compromised device trying to exfiltrate data via DNS. Does that logic seem sound?

I'm running this on my homelab network where I have a few Docker containers, some IoT devices, and my personal machines. I'm curious about a couple of things:

First, are there common false positives I should watch out for? I'm worried something benign like a smart TV or a game console might do weird DNS lookups. Should I maybe place the canary domain entry only on specific subnets or VLANs where I have tighter control, like my server VLAN, rather than my main consumer devices VLAN?

Second, what's the best practice for the logging and alerting side? Right now my script just writes to a text file. I was thinking of piping the logs into my ELK stack or maybe even setting up a webhook to send a notification to a Telegram bot. But I'm not sure what specific details are most valuable to log besides the obvious ones. Should I be capturing the entire DNS packet? The TTL?

Finally, I've read a bit about DNS tunneling tools like dnscat2. Would a simple canary domain like this actually detect those, or do they typically use subdomains of an attacker-controlled domain? If the latter, I guess I'd need a different approach, like monitoring for unusual query volumes or request patterns to *any* domain, not just my canary. Is that something I could also implement with Pi-hole's query logs, or would I need a more advanced setup?

Really excited to learn more from you all. This project has already made me think a lot more about how much trust I put in DNS!