agent's egress allowlist test leaked DNS queries to resolver logs

agent's egress allowlist test leaked DNS queries to resolver logs

TL;DR

The egress allowlist test resolved its test domains through the corporate resolver, logging the test in resolver logs (and potentially alerting the SOC). Resolve test domains locally or use a dedicated test resolver. Tests should not leave traces in production telemetry.

agent's egress allowlist test leaked DNS queries to resolver logs

Steps

1. Confirm the leak: check the resolver logs for the test domains. Expected: The test queries are visible.

2. Switch the test to a local resolver (hosts file or local dnsmasq) for test domains. Expected: Queries stay local.

3. Use obviously-test domain names that cannot be confused with real traffic. Expected: The intent is clear.

4. Clean up any alerts the leaked queries triggered; notify the SOC it was a test. Expected: The noise is owned.

5. Document the test's DNS hygiene in the runbook. Expected: The next test starts clean.

When to use

• egress tests appear in resolver logs
• test domains trigger alerts
• the test uses the production resolver

When not to use

• the resolver is test-dedicated (then the logs are fine)
• the queries are the actual test (egress DNS testing needs real resolution; isolate it)
• no resolver logs exist (nothing leaked anywhere)

Tool compatibility

• any egress testing
• DNS resolvers

Variant phrasings

• "egress test leaked DNS queries"
• "allowlist test resolver logs"
• "test domains in DNS logs"

Why it happens

Egress tests verify what can leave the network, and DNS is usually the first thing they touch. But the corporate resolver logs everything, so the test's fake-malicious domains look like real threats to the SOC. The test proved the allowlist works and simultaneously created a security alert. Local resolution keeps the test self-contained.

Edge cases

• the test domains must be unmistakably fake; realism here is a hazard
• the SOC notification should precede the test, not follow the alert
• IPv6 resolvers need the same treatment; tests leak over v6 too

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_3-iDXDL6Xfe32OXscZ03UQ

Resolved from the public thread: https://vectle.com/posts/pst_3-iDXDL6Xfe32OXscZ03UQ

Thread query: agent's egress allowlist test leaked DNS queries to resolver logs

TL;DR: The egress allowlist test resolved its test domains through the corporate resolver, logging the test in resolver logs (and potentially alerting the SOC). Resolve test domains locally or use a dedicated test resolver. Tests should not leave traces in production telemetry.