不安全的 DNS 设置
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
OWASP 类别：MASVS-NETWORK：网络通信
概览
当开发者自定义应用的 DNS 传输行为、绕过设备默认设置，或者当用户在 Android 9 及更高版本中指定专用 DNS 服务器时，可能会出现不安全的 DNS 配置。偏离已知的良好 DNS 配置可能会导致用户容易受到 DNS 欺骗或 DNS 缓存中毒等攻击，从而使攻击者能够将用户流量重定向到恶意网站。
影响
如果恶意网络攻击者能够欺骗 DNS，他们就可以在不引起用户怀疑的情况下，悄悄将用户重定向到他们控制的网站。例如，此恶意网站可能会通过网络钓鱼窃取用户的个人身份信息、导致用户遭受拒绝服务攻击，或者在不通知用户的情况下将用户重定向到其他网站。
风险：DNS 传输安全性存在漏洞
自定义 DNS 配置可能会允许应用绕过 Android 9 及更高版本中针对 DNS 的内置传输安全性。
缓解措施
使用 Android OS 处理 DNS 流量
允许 Android 操作系统处理 DNS。自 SDK 级别 28 以来，Android 通过 DNS over TLS 为 DNS 传输添加了安全性，然后在 SDK 级别 30 中添加了 DNS over HTTP/3。
使用 SDK 级别 >=28
将 SDK 级别更新为至少 28。请注意，此缓解措施需要与知名且安全的公共 DNS 服务器（例如此处所示的服务器）进行通信。
资源
本页面上的内容和代码示例受内容许可部分所述许可的限制。Java 和 OpenJDK 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-27。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["没有我需要的信息","missingTheInformationINeed","thumb-down"],["太复杂/步骤太多","tooComplicatedTooManySteps","thumb-down"],["内容需要更新","outOfDate","thumb-down"],["翻译问题","translationIssue","thumb-down"],["示例/代码问题","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-07-27。"],[],[],null,["# Insecure DNS Setup\n\n\u003cbr /\u003e\n\n**OWASP category:** [MASVS-NETWORK: Network Communication](https://mas.owasp.org/MASVS/08-MASVS-NETWORK)\n\nOverview\n--------\n\nInsecure DNS configurations can occur when developers customize an application's\nDNS transport behavior, bypass device defaults, or when a user specifies a\nprivate DNS server in Android 9 and later. Deviation from known good DNS\nconfigurations can leave users vulnerable to attacks like DNS Spoofing or DNS\ncache poisoning, allowing attackers to redirect user traffic to malicious sites.\n\nImpact\n------\n\nIf a malicious network attacker is able to spoof DNS, they can discreetly\nredirect the user to a website they control, without arousing the user's\nsuspicion. This malicious website could, for example, phish the user for\npersonally identifiable information, cause a denial of service for the user, or\nredirect the user to websites without notification.\n\nRisk: Vulnerable DNS Transport Security\n---------------------------------------\n\nCustom DNS configurations may allow apps to bypass Android's built-in transport\nsecurity for DNS in Android 9 and higher.\n\n### Mitigations\n\n#### Use the Android OS to handle DNS traffic\n\nAllow the Android OS to handle DNS. Since SDK level 28, Android has added\nsecurity to DNS transport through DNS over TLS, and then DNS over HTTP/3 in SDK\nlevel 30.\n\n#### Use SDK level \\\u003e=28\n\nUpdate SDK level to at least 28. It should be noted that this mitigation\nrequires communication with well-known and secure public DNS servers such as can\nbe found [here](https://dnsprivacy.org/public_resolvers/).\n\nResources\n---------\n\n- [Resolve DNS queries](/training/basics/network-ops/connecting#lookup-dns)\n- [Java reference for DnsResolver Class](/reference/android/net/DnsResolver)\n- [Android Security Blog post about DNS-over-HTTP/3](https://security.googleblog.com/2022/07/dns-over-http3-in-android.html)\n- [Overview of secure transport for DNS](https://developers.google.com/speed/public-dns/docs/secure-transports)\n- [Android Developer Blog post about DNS over TLS](https://android-developers.googleblog.com/2018/04/dns-over-tls-support-in-android-p.html)"]]
