The second argument to both host and nslookup, specifies the server to use
for the lookup. So, you can compare the results of the DNS server specified
in /etc/resolv.conf, with others like those mentioned above, eg
host youtube.com 8.8.8.8
or
nslookup youtube.com 4.2.2.4

However, youtube.com will no doubt be using global server load balancing,
which means the DNS response will be based on the source IP address of the
DNS request, so you can be directed to the closest youtube.com server(s).

So, since you cant be sure the DNS results will be consistent across DNS
servers, you can't use that to determine if you're being MITM'd. Mind you I
don't think a non-targetted MITM would bother with someone's youtube
traffic, but if your concerned about that just connect to youtube with
https, so the certificate can be verified.

Reply via email to