DNS

Synopsis

Creates an emulated DNS server that answers the Active Directory DC-locator SRV record set, so a scanner or tool such as SharpHound concludes a Domain Controller exists at the configured address. Every parsed query is logged, whether it was answered or returned NXDOMAIN.

Schema

- id: <numeric>
  name: <string>
  description: <string>
  type: dns
  tags: <string[]>
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    dns_domain: <string>
    computer_name: <string>
    dc_ip: <string>
    timeout: <numeric>

Configuration

The following fields are used to define the device:

Device

Field	Required	Default	Description
id	Y		Unique identifier
name	Y		Device name
description	N	-	Optional description
type	Y		Must be dns
tags	N	-	Optional tags
pipelines	N	-	Optional pre-processor pipelines
status	N	true	Enable/disable the device

Connection

Field	Required	Default	Description
address	N	"0.0.0.0"	Listen address
port	Y		Listen port
timeout	N	15	TCP connection idle timeout in seconds

note

The listener binds both UDP and TCP on the configured port. timeout applies to the TCP listener only.

Domain

Field	Required	Default	Description
dns_domain	N	"corp.local"	Active Directory domain name answered in SRV and A records
computer_name	N	"DC01"	Host name component of the emulated Domain Controller's FQDN
dc_ip	N	"127.0.0.1"	Address returned in A records and as the SRV target

note

dc_ip is the address returned in A records and as the target of the SRV records. Point it at the host running the sibling honeypot listeners (ssh, vnc, kerberos, and so on), so a resolved lookup leads the attacker to them.

Details

Emulated Records

The device parses the header ID and first question of an incoming query, handling one level of name compression, and answers the Active Directory DC-locator SRV set:

Query name	Port
_ldap._tcp.dc._msdcs.<dns_domain>	389
_ldap._tcp.<dns_domain>	389
_ldap._tcp.pdc._msdcs	389
_ldap._tcp.gc._msdcs	3268
_gc._tcp	3268
_kerberos._tcp	88
_kerberos._udp	88
_kerberos._tcp.dc._msdcs	88
_kpasswd._tcp	464
_kpasswd._udp	464

SRV answers use priority 0, weight 100, and TTL 600, and carry an additional A record for the SRV target. An A query for the Domain Controller's FQDN, derived as lowercase computer_name joined to dns_domain, returns dc_ip. Every other query returns NXDOMAIN. Response flags are QR=1, AA=1, RA=1.

Logged Events

Each parsed question generates the following event type:

event_type	Emitted when
query	A question is parsed from an incoming DNS message

Event Fields

Every event carries timestamp, event_type, source_ip, source_port, and local_addr. The remaining fields depend on the event type:

Field	Description
transport	Transport the query arrived on: udp or tcp
query_name	Queried name
query_type	Queried record type: A, AAAA, SRV, ANY, or a numeric value
matched	Whether the query was answered, as opposed to returning NXDOMAIN
dc_locator	Whether the queried name is one of the DC-locator SRV records

Examples

The following are commonly used configuration types.

Basic

Creating a minimal DNS honeypot on the standard port...

devices: - id: 1 name: basic_dns type: dns properties: port: 53

Domain Controller Locator

Configuring the domain and pointing resolved queries at the host running the other honeypot listeners...

devices: - id: 2 name: dns_dc_locator type: dns properties: port: 53 dns_domain: corp.local computer_name: DC01 dc_ip: "10.0.4.12"

With Pre-Processing

Routing captured queries through a pre-processing pipeline before ingestion...	devices: - id: 3 name: dns_preprocessed type: dns pipelines: - decoy-honeypot-enrich properties: port: 53 dns_domain: corp.local
A DC-locator SRV lookup is logged as a matched, answered query...	{ "timestamp": "2026-08-03T09:14:22.481937204Z", "event_type": "query", "source_ip": "203.0.113.44", "source_port": "51422", "local_addr": "10.0.4.12:53", "transport": "udp", "query_name": "_ldap._tcp.dc._msdcs.corp.local", "query_type": "SRV", "matched": true, "dc_locator": true }