{"id":4267,"date":"2016-04-11T00:25:58","date_gmt":"2016-04-11T05:25:58","guid":{"rendered":"http:\/\/rud.is\/b\/?p=4267"},"modified":"2018-03-07T16:42:45","modified_gmt":"2018-03-07T21:42:45","slug":"clandestine-dns-lookups-with-gdns","status":"publish","type":"post","link":"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/","title":{"rendered":"Clandestine DNS lookups with gdns"},"content":{"rendered":"

Google recently [announced](https:\/\/developers.google.com\/speed\/public-dns\/docs\/dns-over-https) their DNS-over-HTTPS API, which _”enhances privacy and security between a client and a recursive resolver, and complements DNSSEC to provide end-to-end authenticated DNS lookups”_. The REST API they provided was pretty simple to [wrap into a package](https:\/\/github.com\/hrbrmstr\/gdns) and I tossed in some [SPF](http:\/\/www.openspf.org\/SPF_Record_Syntax) functions that I had lying around to bulk it up a bit.<\/p>\n

### Why DNS-over-HTTPS?<\/p>\n

DNS machinations usually happen over UDP (and sometimes TCP). Unless you’re using some fairly modern DNS augmentations, these exchanges happen in cleartext, meaning your query and the response are exposed during transport (and they are already exposed to the server you’re querying for a response). <\/p>\n

DNS queries over HTTPS will be harder to [spoof](http:\/\/www.veracode.com\/security\/spoofing-attack) and the query + response will be encrypted, so you gain transport privacy when, say, you’re at Starbucks or from your DSL, FiOS, Gogo Inflight, or cable internet provider (yes, they all snoop on your DNS queries). <\/p>\n

You end up trusting Google quite a bit with this API, but if you were currently using `8.8.8.8` or `8.8.4.4` (or their IPv6 equivalents) you were already trusting Google (and it’s likely Google knows what you’re doing on the internet anyway given all the trackers and especially if you’re using Chrome).<\/p>\n

One additional item you gain using this API is more control over [`EDNS0`](https:\/\/tools.ietf.org\/html\/draft-vandergaast-edns-client-ip-00) settings. `EDNS0` is a DNS protocol extension that, for example, enables the content delivery networks to pick the “closest” server farm to ensure speedy delivery of your streaming Game of Thrones binge watch. They get to know a piece of your IP address so they can make this decision, but you end up giving away a bit of privacy (though you lose the privacy in the end since the target CDN servers know precisely where you are).<\/p>\n

Right now, there’s no way for most clients to use DNS-over-HTTPS directly, but the API can be used in a programmatic fashion, which may be helpful in situations where you need to do some DNS spelunking but UDP is blocked or you’re on a platform that can’t build the [`resolv`](https:\/\/github.com\/hrbrmstr\/resolv) package.<\/p>\n

You can learn a bit more about DNS and privacy in this [IETF paper](https:\/\/www.ietf.org\/mail-archive\/web\/dns-privacy\/current\/pdfWqAIUmEl47.pdf) [PDF].<\/p>\n

### Mining DNS with `gdns`<\/p>\n

The `gdns` package is pretty straightforward. Use the `query()` function to get DNS info for a single entity:<\/p>\n

library(gdns)\r\n\r\nquery(\"apple.com\")\r\n## $Status  \r\n## [1] 0          # NOERROR - Standard DNS response code (32 bit integer)\r\n## \r\n## $TC\r\n## [1] FALSE      # Whether the response is truncated\r\n## \r\n## $RD\r\n## [1] TRUE       # Should always be true for Google Public DNS\r\n## \r\n## $RA\r\n## [1] TRUE       # Should always be true for Google Public DNS\r\n## \r\n## $AD\r\n## [1] FALSE      # Whether all response data was validated with DNSSEC\r\n## \r\n## $CD\r\n## [1] FALSE      # Whether the client asked to disable DNSSEC\r\n## \r\n## $Question\r\n##         name type\r\n## 1 apple.com.    1\r\n## \r\n## $Answer\r\n##         name type  TTL          data\r\n## 1 apple.com.    1 1547 17.172.224.47\r\n## 2 apple.com.    1 1547  17.178.96.59\r\n## 3 apple.com.    1 1547 17.142.160.59\r\n## \r\n## $Additional\r\n## list()\r\n## \r\n## $edns_client_subnet\r\n## [1] \"0.0.0.0\/0\"<\/pre>\n
The `gdns` lookup functions are set to use an `edns_client_subnet` of `0.0.0.0\/0`, meaning your local IP address or subnet is not leaked outside of your connection to Google (you can override this behavior). <\/p>\n
You can do reverse lookups as well (i.e. query IP addresses):<\/p>\n
query(\"17.172.224.47\", \"PTR\")\r\n## $Status\r\n## [1] 0\r\n## \r\n## $TC\r\n## [1] FALSE\r\n## \r\n## $RD\r\n## [1] TRUE\r\n## \r\n## $RA\r\n## [1] TRUE\r\n## \r\n## $AD\r\n## [1] FALSE\r\n## \r\n## $CD\r\n## [1] FALSE\r\n## \r\n## $Question\r\n##                          name type\r\n## 1 47.224.172.17.in-addr.arpa.   12\r\n## \r\n## $Answer\r\n##                            name type  TTL                           data\r\n## 1   47.224.172.17.in-addr.arpa.   12 1073               webobjects.info.\r\n## 2   47.224.172.17.in-addr.arpa.   12 1073                   yessql.info.\r\n## 3   47.224.172.17.in-addr.arpa.   12 1073                 apples-msk.ru.\r\n## 4   47.224.172.17.in-addr.arpa.   12 1073                     icloud.se.\r\n## 5   47.224.172.17.in-addr.arpa.   12 1073                     icloud.es.\r\n## 6   47.224.172.17.in-addr.arpa.   12 1073                     icloud.om.\r\n## 7   47.224.172.17.in-addr.arpa.   12 1073                   icloudo.com.\r\n## 8   47.224.172.17.in-addr.arpa.   12 1073                     icloud.ch.\r\n## 9   47.224.172.17.in-addr.arpa.   12 1073                     icloud.fr.\r\n## 10  47.224.172.17.in-addr.arpa.   12 1073                   icloude.com.\r\n## 11  47.224.172.17.in-addr.arpa.   12 1073          camelspaceeffect.com.\r\n## 12  47.224.172.17.in-addr.arpa.   12 1073                 camelphat.com.\r\n## 13  47.224.172.17.in-addr.arpa.   12 1073              alchemysynth.com.\r\n## 14  47.224.172.17.in-addr.arpa.   12 1073                    openni.org.\r\n## 15  47.224.172.17.in-addr.arpa.   12 1073                      swell.am.\r\n## 16  47.224.172.17.in-addr.arpa.   12 1073                  appleweb.net.\r\n## 17  47.224.172.17.in-addr.arpa.   12 1073       appleipodsettlement.com.\r\n## 18  47.224.172.17.in-addr.arpa.   12 1073                    earpod.net.\r\n## 19  47.224.172.17.in-addr.arpa.   12 1073                 yourapple.com.\r\n## 20  47.224.172.17.in-addr.arpa.   12 1073                    xserve.net.\r\n## 21  47.224.172.17.in-addr.arpa.   12 1073                    xserve.com.\r\n## 22  47.224.172.17.in-addr.arpa.   12 1073            velocityengine.com.\r\n## 23  47.224.172.17.in-addr.arpa.   12 1073           velocity-engine.com.\r\n## 24  47.224.172.17.in-addr.arpa.   12 1073            universityarts.com.\r\n## 25  47.224.172.17.in-addr.arpa.   12 1073            thinkdifferent.com.\r\n## 26  47.224.172.17.in-addr.arpa.   12 1073               theatremode.com.\r\n## 27  47.224.172.17.in-addr.arpa.   12 1073               theatermode.com.\r\n## 28  47.224.172.17.in-addr.arpa.   12 1073           streamquicktime.net.\r\n## 29  47.224.172.17.in-addr.arpa.   12 1073           streamquicktime.com.\r\n## 30  47.224.172.17.in-addr.arpa.   12 1073                ripmixburn.com.\r\n## 31  47.224.172.17.in-addr.arpa.   12 1073              rip-mix-burn.com.\r\n## 32  47.224.172.17.in-addr.arpa.   12 1073        quicktimestreaming.net.\r\n## 33  47.224.172.17.in-addr.arpa.   12 1073        quicktimestreaming.com.\r\n## 34  47.224.172.17.in-addr.arpa.   12 1073                  quicktime.cc.\r\n## 35  47.224.172.17.in-addr.arpa.   12 1073                      qttv.net.\r\n## 36  47.224.172.17.in-addr.arpa.   12 1073                      qtml.com.\r\n## 37  47.224.172.17.in-addr.arpa.   12 1073                     qt-tv.net.\r\n## 38  47.224.172.17.in-addr.arpa.   12 1073          publishingsurvey.org.\r\n## 39  47.224.172.17.in-addr.arpa.   12 1073          publishingsurvey.com.\r\n## 40  47.224.172.17.in-addr.arpa.   12 1073        publishingresearch.org.\r\n## 41  47.224.172.17.in-addr.arpa.   12 1073        publishingresearch.com.\r\n## 42  47.224.172.17.in-addr.arpa.   12 1073         publishing-survey.org.\r\n## 43  47.224.172.17.in-addr.arpa.   12 1073         publishing-survey.com.\r\n## 44  47.224.172.17.in-addr.arpa.   12 1073       publishing-research.org.\r\n## 45  47.224.172.17.in-addr.arpa.   12 1073       publishing-research.com.\r\n## 46  47.224.172.17.in-addr.arpa.   12 1073                  powerbook.cc.\r\n## 47  47.224.172.17.in-addr.arpa.   12 1073             playquicktime.net.\r\n## 48  47.224.172.17.in-addr.arpa.   12 1073             playquicktime.com.\r\n## 49  47.224.172.17.in-addr.arpa.   12 1073           nwk-apple.apple.com.\r\n## 50  47.224.172.17.in-addr.arpa.   12 1073                   myapple.net.\r\n## 51  47.224.172.17.in-addr.arpa.   12 1073                  macreach.net.\r\n## 52  47.224.172.17.in-addr.arpa.   12 1073                  macreach.com.\r\n## 53  47.224.172.17.in-addr.arpa.   12 1073                   macmate.com.\r\n## 54  47.224.172.17.in-addr.arpa.   12 1073         macintoshsoftware.com.\r\n## 55  47.224.172.17.in-addr.arpa.   12 1073                    machos.net.\r\n## 56  47.224.172.17.in-addr.arpa.   12 1073                   mach-os.net.\r\n## 57  47.224.172.17.in-addr.arpa.   12 1073                   mach-os.com.\r\n## 58  47.224.172.17.in-addr.arpa.   12 1073                   ischool.com.\r\n## 59  47.224.172.17.in-addr.arpa.   12 1073           insidemacintosh.com.\r\n## 60  47.224.172.17.in-addr.arpa.   12 1073             imovietheater.com.\r\n## 61  47.224.172.17.in-addr.arpa.   12 1073               imoviestage.com.\r\n## 62  47.224.172.17.in-addr.arpa.   12 1073             imoviegallery.com.\r\n## 63  47.224.172.17.in-addr.arpa.   12 1073               imacsources.com.\r\n## 64  47.224.172.17.in-addr.arpa.   12 1073        imac-applecomputer.com.\r\n## 65  47.224.172.17.in-addr.arpa.   12 1073                imac-apple.com.\r\n## 66  47.224.172.17.in-addr.arpa.   12 1073                     ikids.com.\r\n## 67  47.224.172.17.in-addr.arpa.   12 1073              ibookpartner.com.\r\n## 68  47.224.172.17.in-addr.arpa.   12 1073                   geoport.com.\r\n## 69  47.224.172.17.in-addr.arpa.   12 1073                   firewire.cl.\r\n## 70  47.224.172.17.in-addr.arpa.   12 1073               expertapple.com.\r\n## 71  47.224.172.17.in-addr.arpa.   12 1073              edu-research.org.\r\n## 72  47.224.172.17.in-addr.arpa.   12 1073               dvdstudiopro.us.\r\n## 73  47.224.172.17.in-addr.arpa.   12 1073              dvdstudiopro.org.\r\n## 74  47.224.172.17.in-addr.arpa.   12 1073              dvdstudiopro.net.\r\n## 75  47.224.172.17.in-addr.arpa.   12 1073             dvdstudiopro.info.\r\n## 76  47.224.172.17.in-addr.arpa.   12 1073              dvdstudiopro.com.\r\n## 77  47.224.172.17.in-addr.arpa.   12 1073              dvdstudiopro.biz.\r\n## 78  47.224.172.17.in-addr.arpa.   12 1073          developercentral.com.\r\n## 79  47.224.172.17.in-addr.arpa.   12 1073             desktopmovies.org.\r\n## 80  47.224.172.17.in-addr.arpa.   12 1073             desktopmovies.net.\r\n## 81  47.224.172.17.in-addr.arpa.   12 1073              desktopmovie.org.\r\n## 82  47.224.172.17.in-addr.arpa.   12 1073              desktopmovie.net.\r\n## 83  47.224.172.17.in-addr.arpa.   12 1073              desktopmovie.com.\r\n## 84  47.224.172.17.in-addr.arpa.   12 1073          darwinsourcecode.com.\r\n## 85  47.224.172.17.in-addr.arpa.   12 1073              darwinsource.org.\r\n## 86  47.224.172.17.in-addr.arpa.   12 1073              darwinsource.com.\r\n## 87  47.224.172.17.in-addr.arpa.   12 1073                darwincode.com.\r\n## 88  47.224.172.17.in-addr.arpa.   12 1073                carbontest.com.\r\n## 89  47.224.172.17.in-addr.arpa.   12 1073              carbondating.com.\r\n## 90  47.224.172.17.in-addr.arpa.   12 1073                 carbonapi.com.\r\n## 91  47.224.172.17.in-addr.arpa.   12 1073           braeburncapital.com.\r\n## 92  47.224.172.17.in-addr.arpa.   12 1073                  applexpo.net.\r\n## 93  47.224.172.17.in-addr.arpa.   12 1073                  applexpo.com.\r\n## 94  47.224.172.17.in-addr.arpa.   12 1073                applereach.net.\r\n## 95  47.224.172.17.in-addr.arpa.   12 1073                applereach.com.\r\n## 96  47.224.172.17.in-addr.arpa.   12 1073            appleiservices.com.\r\n## 97  47.224.172.17.in-addr.arpa.   12 1073     applefinalcutproworld.org.\r\n## 98  47.224.172.17.in-addr.arpa.   12 1073     applefinalcutproworld.net.\r\n## 99  47.224.172.17.in-addr.arpa.   12 1073     applefinalcutproworld.com.\r\n## 100 47.224.172.17.in-addr.arpa.   12 1073            applefilmmaker.com.\r\n## 101 47.224.172.17.in-addr.arpa.   12 1073             applefilmaker.com.\r\n## 102 47.224.172.17.in-addr.arpa.   12 1073                appleenews.com.\r\n## 103 47.224.172.17.in-addr.arpa.   12 1073               appledarwin.org.\r\n## 104 47.224.172.17.in-addr.arpa.   12 1073               appledarwin.net.\r\n## 105 47.224.172.17.in-addr.arpa.   12 1073               appledarwin.com.\r\n## 106 47.224.172.17.in-addr.arpa.   12 1073         applecomputerimac.com.\r\n## 107 47.224.172.17.in-addr.arpa.   12 1073        applecomputer-imac.com.\r\n## 108 47.224.172.17.in-addr.arpa.   12 1073                  applecare.cc.\r\n## 109 47.224.172.17.in-addr.arpa.   12 1073               applecarbon.com.\r\n## 110 47.224.172.17.in-addr.arpa.   12 1073                 apple-inc.net.\r\n## 111 47.224.172.17.in-addr.arpa.   12 1073               apple-enews.com.\r\n## 112 47.224.172.17.in-addr.arpa.   12 1073              apple-darwin.org.\r\n## 113 47.224.172.17.in-addr.arpa.   12 1073              apple-darwin.net.\r\n## 114 47.224.172.17.in-addr.arpa.   12 1073              apple-darwin.com.\r\n## 115 47.224.172.17.in-addr.arpa.   12 1073                  mobileme.com.\r\n## 116 47.224.172.17.in-addr.arpa.   12 1073                ipa-iphone.net.\r\n## 117 47.224.172.17.in-addr.arpa.   12 1073               jetfuelapps.com.\r\n## 118 47.224.172.17.in-addr.arpa.   12 1073                jetfuelapp.com.\r\n## 119 47.224.172.17.in-addr.arpa.   12 1073                   burstly.net.\r\n## 120 47.224.172.17.in-addr.arpa.   12 1073             appmediagroup.com.\r\n## 121 47.224.172.17.in-addr.arpa.   12 1073             airsupportapp.com.\r\n## 122 47.224.172.17.in-addr.arpa.   12 1073            burstlyrewards.com.\r\n## 123 47.224.172.17.in-addr.arpa.   12 1073        surveys-temp.apple.com.\r\n## 124 47.224.172.17.in-addr.arpa.   12 1073               appleiphone.com.\r\n## 125 47.224.172.17.in-addr.arpa.   12 1073                       asto.re.\r\n## 126 47.224.172.17.in-addr.arpa.   12 1073                 itunesops.com.\r\n## 127 47.224.172.17.in-addr.arpa.   12 1073                     apple.com.\r\n## 128 47.224.172.17.in-addr.arpa.   12 1073     st11p01ww-apple.apple.com.\r\n## 129 47.224.172.17.in-addr.arpa.   12 1073                      apple.by.\r\n## 130 47.224.172.17.in-addr.arpa.   12 1073                 airtunes.info.\r\n## 131 47.224.172.17.in-addr.arpa.   12 1073              applecentre.info.\r\n## 132 47.224.172.17.in-addr.arpa.   12 1073         applecomputerinc.info.\r\n## 133 47.224.172.17.in-addr.arpa.   12 1073                appleexpo.info.\r\n## 134 47.224.172.17.in-addr.arpa.   12 1073             applemasters.info.\r\n## 135 47.224.172.17.in-addr.arpa.   12 1073                 applepay.info.\r\n## 136 47.224.172.17.in-addr.arpa.   12 1073 applepaymerchantsupplies.info.\r\n## 137 47.224.172.17.in-addr.arpa.   12 1073         applepaysupplies.info.\r\n## 138 47.224.172.17.in-addr.arpa.   12 1073              applescript.info.\r\n## 139 47.224.172.17.in-addr.arpa.   12 1073               appleshare.info.\r\n## 140 47.224.172.17.in-addr.arpa.   12 1073                   macosx.info.\r\n## 141 47.224.172.17.in-addr.arpa.   12 1073                powerbook.info.\r\n## 142 47.224.172.17.in-addr.arpa.   12 1073                 powermac.info.\r\n## 143 47.224.172.17.in-addr.arpa.   12 1073            quicktimelive.info.\r\n## 144 47.224.172.17.in-addr.arpa.   12 1073              quicktimetv.info.\r\n## 145 47.224.172.17.in-addr.arpa.   12 1073                 sherlock.info.\r\n## 146 47.224.172.17.in-addr.arpa.   12 1073            shopdifferent.info.\r\n## 147 47.224.172.17.in-addr.arpa.   12 1073                 skyvines.info.\r\n## 148 47.224.172.17.in-addr.arpa.   12 1073                     ubnw.info.\r\n## \r\n## $Additional\r\n## list()\r\n## \r\n## $edns_client_subnet\r\n## [1] \"0.0.0.0\/0\"<\/pre>\n
And, you can go “easter egg” hunting:<\/p>\n
cat(query(\"google-public-dns-a.google.com\", \"TXT\")$Answer$data)\r\n## \"http:\/\/xkcd.com\/1361\/\"<\/pre>\n
Note that Google DNS-over-HTTPS supports [all the RR types](http:\/\/www.iana.org\/assignments\/dns-parameters\/dns-parameters.xhtml#dns-parameters-4).<\/p>\n
If you have more than a few domains to lookup and are querying for the same RR record, you can use the `bulk_query()` function:<\/p>\n
hosts <- c(\"rud.is\", \"dds.ec\", \"r-project.org\", \"rstudio.com\", \"apple.com\")\r\nbulk_query(hosts)\r\n## Source: local data frame [7 x 4]\r\n## \r\n##             name  type   TTL            data\r\n##            (chr) (int) (int)           (chr)\r\n## 1        rud.is.     1  3599 104.236.112.222\r\n## 2        dds.ec.     1   299   162.243.111.4\r\n## 3 r-project.org.     1  3601   137.208.57.37\r\n## 4   rstudio.com.     1  3599    45.79.156.36\r\n## 5     apple.com.     1  1088   17.172.224.47\r\n## 6     apple.com.     1  1088    17.178.96.59\r\n## 7     apple.com.     1  1088   17.142.160.59<\/pre>\n
Note that this function only returns a `data_frame` (none of the status fields).<\/p>\n
### More DNSpelunking with `gdns`<\/p>\n
DNS records contain a treasure trove of data (at least for cybersecurity researchers). Say you have a list of base, primary domains for the Fortune 1000:<\/p>\n
library(readr)\r\nlibrary(urltools)\r\n\r\nURL <- \"https:\/\/gist.githubusercontent.com\/hrbrmstr\/ae574201af3de035c684\/raw\/2d21bb4132b77b38f2992dfaab99649397f238e9\/f1000.csv\"\r\nfil <- basename(URL)\r\nif (!file.exists(fil)) download.file(URL, fil)\r\n\r\nf1k <- read_csv(fil)\r\n\r\ndoms1k <- suffix_extract(domain(f1k$website))\r\ndoms1k <- paste(doms1k$domain, doms1k$suffix, sep=\".\")\r\n\r\nhead(doms1k)\r\n## [1] \"walmart.com\"           \"exxonmobil.com\"       \r\n## [3] \"chevron.com\"           \"berkshirehathaway.com\"\r\n## [5] \"apple.com\"             \"gm.com\"  \r\n<\/pre>\n
We can get all the `TXT` records for them:<\/p>\n
library(parallel)\r\nlibrary(doParallel) # parallel ops will make this go faster\r\nlibrary(foreach)\r\nlibrary(dplyr)\r\nlibrary(ggplot2)\r\nlibrary(grid)\r\nlibrary(hrbrmrkdn)\r\n\r\ncl <- makePSOCKcluster(4)\r\nregisterDoParallel(cl)\r\n\r\nf1k_l <- foreach(dom=doms1k) %dopar% gdns::bulk_query(dom, \"TXT\")\r\nf1k <- bind_rows(f1k_l)\r\n\r\nlength(unique(f1k$name))\r\n## [1] 858\r\n\r\ndf <- count(count(f1k, name), `Number of TXT records`=n)\r\ndf <- bind_rows(df, data_frame(`Number of TXT records`=0, n=142))\r\n\r\ngg <- ggplot(df, aes(`Number of TXT records`, n))\r\ngg <- gg + geom_bar(stat=\"identity\", width=0.75)\r\ngg <- gg + scale_x_continuous(expand=c(0,0), breaks=0:13)\r\ngg <- gg + scale_y_continuous(expand=c(0,0))\r\ngg <- gg + labs(y=\"# Orgs\", \r\n                title=\"TXT record count per Fortune 1000 Org\")\r\ngg <- gg + theme_hrbrmstr(grid=\"Y\", axis=\"xy\")\r\ngg <- gg + theme(axis.title.x=element_text(margin=margin(t=-22)))\r\ngg <- gg + theme(axis.title.y=element_text(angle=0, vjust=1, \r\n                                           margin=margin(r=-49)))\r\ngg <- gg + theme(plot.margin=margin(t=10, l=30, b=30, r=10))\r\ngg <- gg + theme(plot.title=element_text(margin=margin(b=20)))\r\ngg\r\n<\/pre>\n
\"Fullscreen_4_11_16__12_35_AM\"<\/a><\/p>\n
We can see that 858 of the Fortune 1000 have `TXT` records and more than a few have between 2 and 5 of them. Why look at `TXT` records? Well, they can tell us things like who uses cloud e-mail services, such as Outlook365:<\/p>\n
sort(f1k$name[which(grepl(\"(MS=|outlook)\", spf_includes(f1k$data), ignore.case=TRUE))])\r\n##   [1] \"21cf.com.\"                  \"77nrg.com.\"                 \"abbott.com.\"                \"acuitybrands.com.\"         \r\n##   [5] \"adm.com.\"                   \"adobe.com.\"                 \"alaskaair.com.\"             \"aleris.com.\"               \r\n##   [9] \"allergan.com.\"              \"altria.com.\"                \"amark.com.\"                 \"ameren.com.\"               \r\n##  [13] \"americantower.com.\"         \"ametek.com.\"                \"amkor.com.\"                 \"amphenol.com.\"             \r\n##  [17] \"amwater.com.\"               \"analog.com.\"                \"anixter.com.\"               \"apachecorp.com.\"           \r\n##  [21] \"archrock.com.\"              \"archrock.com.\"              \"armstrong.com.\"             \"aschulman.com.\"            \r\n##  [25] \"assurant.com.\"              \"autonation.com.\"            \"autozone.com.\"              \"axiall.com.\"               \r\n##  [29] \"bd.com.\"                    \"belk.com.\"                  \"biglots.com.\"               \"bio-rad.com.\"              \r\n##  [33] \"biomet.com.\"                \"bloominbrands.com.\"         \"bms.com.\"                   \"borgwarner.com.\"           \r\n##  [37] \"boydgaming.com.\"            \"brinks.com.\"                \"brocade.com.\"               \"brunswick.com.\"            \r\n##  [41] \"cabotog.com.\"               \"caleres.com.\"               \"campbellsoupcompany.com.\"   \"carefusion.com.\"           \r\n##  [45] \"carlyle.com.\"               \"cartech.com.\"               \"cbrands.com.\"               \"cbre.com.\"                 \r\n##  [49] \"chemtura.com.\"              \"chipotle.com.\"              \"chiquita.com.\"              \"churchdwight.com.\"         \r\n##  [53] \"cinemark.com.\"              \"cintas.com.\"                \"cmc.com.\"                   \"cmsenergy.com.\"            \r\n##  [57] \"cognizant.com.\"             \"colfaxcorp.com.\"            \"columbia.com.\"              \"commscope.com.\"            \r\n##  [61] \"con-way.com.\"               \"convergys.com.\"             \"couche-tard.com.\"           \"crestwoodlp.com.\"          \r\n##  [65] \"crowncastle.com.\"           \"crowncork.com.\"             \"csx.com.\"                   \"cummins.com.\"              \r\n##  [69] \"cunamutual.com.\"            \"dana.com.\"                  \"darlingii.com.\"             \"deanfoods.com.\"            \r\n##  [73] \"dentsplysirona.com.\"        \"discoverfinancial.com.\"     \"disney.com.\"                \"donaldson.com.\"            \r\n##  [77] \"drhorton.com.\"              \"dupont.com.\"                \"dyn-intl.com.\"              \"dynegy.com.\"               \r\n##  [81] \"ea.com.\"                    \"eastman.com.\"               \"ecolab.com.\"                \"edgewell.com.\"             \r\n##  [85] \"edwards.com.\"               \"emc.com.\"                   \"enablemidstream.com.\"       \"energyfutureholdings.com.\" \r\n##  [89] \"energytransfer.com.\"        \"eogresources.com.\"          \"equinix.com.\"               \"expeditors.com.\"           \r\n##  [93] \"express.com.\"               \"fastenal.com.\"              \"ferrellgas.com.\"            \"fisglobal.com.\"            \r\n##  [97] \"flowserve.com.\"             \"fmglobal.com.\"              \"fnf.com.\"                   \"g-iii.com.\"                \r\n## [101] \"genpt.com.\"                 \"ggp.com.\"                   \"gilead.com.\"                \"goodyear.com.\"             \r\n## [105] \"grainger.com.\"              \"graphicpkg.com.\"            \"hanes.com.\"                 \"hanover.com.\"              \r\n## [109] \"harley-davidson.com.\"       \"harsco.com.\"                \"hasbro.com.\"                \"hbfuller.com.\"             \r\n## [113] \"hei.com.\"                   \"hhgregg.com.\"               \"hnicorp.com.\"               \"homedepot.com.\"            \r\n## [117] \"hpinc.com.\"                 \"hubgroup.com.\"              \"iac.com.\"                   \"igt.com.\"                  \r\n## [121] \"iheartmedia.com.\"           \"insperity.com.\"             \"itt.com.\"                   \"itw.com.\"                  \r\n## [125] \"jarden.com.\"                \"jcpenney.com.\"              \"jll.com.\"                   \"joyglobal.com.\"            \r\n## [129] \"juniper.net.\"               \"kellyservices.com.\"         \"kennametal.com.\"            \"kiewit.com.\"               \r\n## [133] \"kindermorgan.com.\"          \"kindredhealthcare.com.\"     \"kodak.com.\"                 \"lamresearch.com.\"          \r\n## [137] \"lansingtradegroup.com.\"     \"lennar.com.\"                \"levistrauss.com.\"           \"lithia.com.\"               \r\n## [141] \"manitowoc.com.\"             \"manpowergroup.com.\"         \"marathonoil.com.\"           \"marathonpetroleum.com.\"    \r\n## [145] \"mastec.com.\"                \"mastercard.com.\"            \"mattel.com.\"                \"maximintegrated.com.\"      \r\n## [149] \"mednax.com.\"                \"mercuryinsurance.com.\"      \"mgmresorts.com.\"            \"micron.com.\"               \r\n## [153] \"mohawkind.com.\"             \"molsoncoors.com.\"           \"mosaicco.com.\"              \"motorolasolutions.com.\"    \r\n## [157] \"mpgdriven.com.\"             \"mscdirect.com.\"             \"mtb.com.\"                   \"murphyoilcorp.com.\"        \r\n## [161] \"mutualofomaha.com.\"         \"mwv.com.\"                   \"navistar.com.\"              \"nbty.com.\"                 \r\n## [165] \"newellrubbermaid.com.\"      \"nexeosolutions.com.\"        \"nike.com.\"                  \"nobleenergyinc.com.\"       \r\n## [169] \"o-i.com.\"                   \"oge.com.\"                   \"olin.com.\"                  \"omnicomgroup.com.\"         \r\n## [173] \"onsemi.com.\"                \"owens-minor.com.\"           \"paychex.com.\"               \"peabodyenergy.com.\"        \r\n## [177] \"pepboys.com.\"               \"pmi.com.\"                   \"pnkinc.com.\"                \"polaris.com.\"              \r\n## [181] \"polyone.com.\"               \"postholdings.com.\"          \"ppg.com.\"                   \"prudential.com.\"           \r\n## [185] \"qg.com.\"                    \"quantaservices.com.\"        \"quintiles.com.\"             \"rcscapital.com.\"           \r\n## [189] \"rexnord.com.\"               \"roberthalf.com.\"            \"rushenterprises.com.\"       \"ryland.com.\"               \r\n## [193] \"sandisk.com.\"               \"sands.com.\"                 \"scansource.com.\"            \"sempra.com.\"               \r\n## [197] \"sonoco.com.\"                \"spiritaero.com.\"            \"sprouts.com.\"               \"stanleyblackanddecker.com.\"\r\n## [201] \"starwoodhotels.com.\"        \"steelcase.com.\"             \"stryker.com.\"               \"sunedison.com.\"            \r\n## [205] \"sunpower.com.\"              \"supervalu.com.\"             \"swifttrans.com.\"            \"synnex.com.\"               \r\n## [209] \"taylormorrison.com.\"        \"techdata.com.\"              \"tegna.com.\"                 \"tempursealy.com.\"          \r\n## [213] \"tetratech.com.\"             \"theice.com.\"                \"thermofisher.com.\"          \"tjx.com.\"                  \r\n## [217] \"trueblue.com.\"              \"ufpi.com.\"                  \"ulta.com.\"                  \"unfi.com.\"                 \r\n## [221] \"unifiedgrocers.com.\"        \"universalcorp.com.\"         \"vishay.com.\"                \"visteon.com.\"              \r\n## [225] \"vwr.com.\"                   \"westarenergy.com.\"          \"westernunion.com.\"          \"westrock.com.\"             \r\n## [229] \"wfscorp.com.\"               \"whitewave.com.\"             \"wpxenergy.com.\"             \"wyndhamworldwide.com.\"     \r\n## [233] \"xilinx.com.\"                \"xpo.com.\"                   \"yum.com.\"                   \"zimmerbiomet.com.\" <\/pre>\n
That's 236 of them outsourcing some part of e-mail services to Microsoft.<\/p>\n
We can also see which ones have terrible mail configs (`+all` or `all` passing):<\/p>\n
f1k[which(passes_all(f1k$data)),]$name\r\n## [1] \"wfscorp.com.\"      \"dupont.com.\"       \"group1auto.com.\"   \"uhsinc.com.\"      \r\n## [5] \"bigheartpet.com.\"  \"pcconnection.com.\"\r\n<\/pre>\n
or are configured for Exchange federation services:<\/p>\n
sort(f1k$name[which(grepl(\"==\", f1k$data))])\r\n## sort(f1k$name[which(grepl(\"==\", f1k$data))])\r\n##   [1] \"21cf.com.\"                 \"aarons.com.\"               \"abbott.com.\"               \"abbvie.com.\"              \r\n##   [5] \"actavis.com.\"              \"activisionblizzard.com.\"   \"acuitybrands.com.\"         \"adm.com.\"                 \r\n##   [9] \"adobe.com.\"                \"adt.com.\"                  \"advanceautoparts.com.\"     \"aecom.com.\"               \r\n##  [13] \"aetna.com.\"                \"agilent.com.\"              \"airproducts.com.\"          \"alcoa.com.\"               \r\n##  [17] \"aleris.com.\"               \"allergan.com.\"             \"alliancedata.com.\"         \"amcnetworks.com.\"         \r\n##  [21] \"amd.com.\"                  \"americantower.com.\"        \"amfam.com.\"                \"amgen.com.\"               \r\n##  [25] \"amtrustgroup.com.\"         \"amtrustgroup.com.\"         \"amtrustgroup.com.\"         \"amtrustgroup.com.\"        \r\n##  [29] \"anadarko.com.\"             \"analog.com.\"               \"apachecorp.com.\"           \"applied.com.\"             \r\n##  [33] \"aptar.com.\"                \"aramark.com.\"              \"aramark.com.\"              \"arcb.com.\"                \r\n##  [37] \"archcoal.com.\"             \"armstrong.com.\"            \"armstrong.com.\"            \"arrow.com.\"               \r\n##  [41] \"asburyauto.com.\"           \"autonation.com.\"           \"avnet.com.\"                \"ball.com.\"                \r\n##  [45] \"bankofamerica.com.\"        \"baxter.com.\"               \"bc.com.\"                   \"bd.com.\"                  \r\n##  [49] \"bd.com.\"                   \"bd.com.\"                   \"belden.com.\"               \"bemis.com.\"               \r\n##  [53] \"bestbuy.com.\"              \"biogen.com.\"               \"biomet.com.\"               \"bloominbrands.com.\"       \r\n##  [57] \"bms.com.\"                  \"boeing.com.\"               \"bonton.com.\"               \"borgwarner.com.\"          \r\n##  [61] \"brinks.com.\"               \"brocade.com.\"              \"brunswick.com.\"            \"c-a-m.com.\"               \r\n##  [65] \"ca.com.\"                   \"cabelas.com.\"              \"cabotog.com.\"              \"caleres.com.\"             \r\n##  [69] \"caleres.com.\"              \"caleres.com.\"              \"calpine.com.\"              \"capitalone.com.\"          \r\n##  [73] \"cardinal.com.\"             \"carlyle.com.\"              \"carlyle.com.\"              \"cartech.com.\"             \r\n##  [77] \"cbre.com.\"                 \"celgene.com.\"              \"centene.com.\"              \"centurylink.com.\"         \r\n##  [81] \"cerner.com.\"               \"cerner.com.\"               \"cfindustries.com.\"         \"ch2m.com.\"                \r\n##  [85] \"chevron.com.\"              \"chipotle.com.\"             \"chiquita.com.\"             \"chk.com.\"                 \r\n##  [89] \"chrobinson.com.\"           \"chs.net.\"                  \"chsinc.com.\"               \"chubb.com.\"               \r\n##  [93] \"ciena.com.\"                \"cigna.com.\"                \"cinemark.com.\"             \"cit.com.\"                 \r\n##  [97] \"cmc.com.\"                  \"cmegroup.com.\"             \"coach.com.\"                \"cognizant.com.\"           \r\n## [101] \"cokecce.com.\"              \"colfaxcorp.com.\"           \"columbia.com.\"             \"commscope.com.\"           \r\n## [105] \"con-way.com.\"              \"conagrafoods.com.\"         \"conocophillips.com.\"       \"coopertire.com.\"          \r\n## [109] \"core-mark.com.\"            \"crbard.com.\"               \"crestwoodlp.com.\"          \"crowncastle.com.\"         \r\n## [113] \"crowncork.com.\"            \"csx.com.\"                  \"danaher.com.\"              \"darden.com.\"              \r\n## [117] \"darlingii.com.\"            \"davita.com.\"               \"davita.com.\"               \"davita.com.\"              \r\n## [121] \"dentsplysirona.com.\"       \"diebold.com.\"              \"diplomat.is.\"              \"dish.com.\"                \r\n## [125] \"disney.com.\"               \"donaldson.com.\"            \"dresser-rand.com.\"         \"dstsystems.com.\"          \r\n## [129] \"dupont.com.\"               \"dupont.com.\"               \"dyn-intl.com.\"             \"dyn-intl.com.\"            \r\n## [133] \"dynegy.com.\"               \"ea.com.\"                   \"ea.com.\"                   \"eastman.com.\"             \r\n## [137] \"ebay.com.\"                 \"echostar.com.\"             \"ecolab.com.\"               \"edmc.edu.\"                \r\n## [141] \"edwards.com.\"              \"elcompanies.com.\"          \"emc.com.\"                  \"emerson.com.\"             \r\n## [145] \"energyfutureholdings.com.\" \"energytransfer.com.\"       \"eogresources.com.\"         \"equinix.com.\"             \r\n## [149] \"essendant.com.\"            \"esterline.com.\"            \"evhc.net.\"                 \"exelisinc.com.\"           \r\n## [153] \"exeloncorp.com.\"           \"express-scripts.com.\"      \"express.com.\"              \"express.com.\"             \r\n## [157] \"exxonmobil.com.\"           \"familydollar.com.\"         \"fanniemae.com.\"            \"fastenal.com.\"            \r\n## [161] \"fbhs.com.\"                 \"ferrellgas.com.\"           \"firstenergycorp.com.\"      \"firstsolar.com.\"          \r\n## [165] \"fiserv.com.\"               \"flowserve.com.\"            \"fmc.com.\"                  \"fmglobal.com.\"            \r\n## [169] \"fnf.com.\"                  \"freddiemac.com.\"           \"ge.com.\"                   \"genpt.com.\"               \r\n## [173] \"genworth.com.\"             \"ggp.com.\"                  \"grace.com.\"                \"grainger.com.\"            \r\n## [177] \"graphicpkg.com.\"           \"graybar.com.\"              \"guess.com.\"                \"hain.com.\"                \r\n## [181] \"halliburton.com.\"          \"hanes.com.\"                \"hanes.com.\"                \"harley-davidson.com.\"     \r\n## [185] \"harman.com.\"               \"harris.com.\"               \"harsco.com.\"               \"hasbro.com.\"              \r\n## [189] \"hcahealthcare.com.\"        \"hcc.com.\"                  \"hei.com.\"                  \"henryschein.com.\"         \r\n## [193] \"hess.com.\"                 \"hhgregg.com.\"              \"hnicorp.com.\"              \"hollyfrontier.com.\"       \r\n## [197] \"hologic.com.\"              \"honeywell.com.\"            \"hospira.com.\"              \"hp.com.\"                  \r\n## [201] \"hpinc.com.\"                \"hrblock.com.\"              \"iac.com.\"                  \"igt.com.\"                 \r\n## [205] \"iheartmedia.com.\"          \"imshealth.com.\"            \"ingrammicro.com.\"          \"intel.com.\"               \r\n## [209] \"interpublic.com.\"          \"intuit.com.\"               \"ironmountain.com.\"         \"jacobs.com.\"              \r\n## [213] \"jarden.com.\"               \"jcpenney.com.\"             \"jll.com.\"                  \"johndeere.com.\"           \r\n## [217] \"johndeere.com.\"            \"joyglobal.com.\"            \"juniper.net.\"              \"karauctionservices.com.\"  \r\n## [221] \"kbhome.com.\"               \"kemper.com.\"               \"keurig.com.\"               \"khov.com.\"                \r\n## [225] \"kindredhealthcare.com.\"    \"kkr.com.\"                  \"kla-tencor.com.\"           \"labcorp.com.\"             \r\n## [229] \"labcorp.com.\"              \"lamresearch.com.\"          \"lamresearch.com.\"          \"landolakesinc.com.\"       \r\n## [233] \"lansingtradegroup.com.\"    \"lear.com.\"                 \"leggmason.com.\"            \"leidos.com.\"              \r\n## [237] \"level3.com.\"               \"libertymutual.com.\"        \"lilly.com.\"                \"lithia.com.\"              \r\n## [241] \"livenation.com.\"           \"lkqcorp.com.\"              \"loews.com.\"                \"magellanhealth.com.\"      \r\n## [245] \"manitowoc.com.\"            \"marathonoil.com.\"          \"marathonpetroleum.com.\"    \"markelcorp.com.\"          \r\n## [249] \"markwest.com.\"             \"marriott.com.\"             \"martinmarietta.com.\"       \"masco.com.\"               \r\n## [253] \"massmutual.com.\"           \"mastec.com.\"               \"mastercard.com.\"           \"mattel.com.\"              \r\n## [257] \"maximintegrated.com.\"      \"mckesson.com.\"             \"mercuryinsurance.com.\"     \"meritor.com.\"             \r\n## [261] \"metlife.com.\"              \"mgmresorts.com.\"           \"micron.com.\"               \"microsoft.com.\"           \r\n## [265] \"mohawkind.com.\"            \"molsoncoors.com.\"          \"monsanto.com.\"             \"mosaicco.com.\"            \r\n## [269] \"motorolasolutions.com.\"    \"mscdirect.com.\"            \"murphyoilcorp.com.\"        \"nasdaqomx.com.\"           \r\n## [273] \"navistar.com.\"             \"nbty.com.\"                 \"ncr.com.\"                  \"netapp.com.\"              \r\n## [277] \"newfield.com.\"             \"newscorp.com.\"             \"nike.com.\"                 \"nov.com.\"                 \r\n## [281] \"nrgenergy.com.\"            \"ntenergy.com.\"             \"nucor.com.\"                \"nustarenergy.com.\"        \r\n## [285] \"o-i.com.\"                  \"oaktreecapital.com.\"       \"ocwen.com.\"                \"omnicare.com.\"            \r\n## [289] \"oneok.com.\"                \"oneok.com.\"                \"onsemi.com.\"               \"outerwall.com.\"           \r\n## [293] \"owens-minor.com.\"          \"owens-minor.com.\"          \"oxy.com.\"                  \"packagingcorp.com.\"       \r\n## [297] \"pall.com.\"                 \"parexel.com.\"              \"paychex.com.\"              \"pcconnection.com.\"        \r\n## [301] \"penskeautomotive.com.\"     \"pepsico.com.\"              \"pfizer.com.\"               \"pg.com.\"                  \r\n## [305] \"polaris.com.\"              \"polyone.com.\"              \"pplweb.com.\"               \"principal.com.\"           \r\n## [309] \"protective.com.\"           \"publix.com.\"               \"qg.com.\"                   \"questdiagnostics.com.\"    \r\n## [313] \"quintiles.com.\"            \"rcscapital.com.\"           \"realogy.com.\"              \"regmovies.com.\"           \r\n## [317] \"rentacenter.com.\"          \"republicservices.com.\"     \"rexnord.com.\"              \"reynoldsamerican.com.\"    \r\n## [321] \"reynoldsamerican.com.\"     \"rgare.com.\"                \"roberthalf.com.\"           \"rpc.net.\"                 \r\n## [325] \"rushenterprises.com.\"      \"safeway.com.\"              \"saic.com.\"                 \"sandisk.com.\"             \r\n## [329] \"scana.com.\"                \"scansource.com.\"           \"seaboardcorp.com.\"         \"selective.com.\"           \r\n## [333] \"selective.com.\"            \"sempra.com.\"               \"servicemaster.com.\"        \"servicemaster.com.\"       \r\n## [337] \"servicemaster.com.\"        \"sjm.com.\"                  \"sm-energy.com.\"            \"spectraenergy.com.\"       \r\n## [341] \"spiritaero.com.\"           \"sprouts.com.\"              \"spx.com.\"                  \"staples.com.\"             \r\n## [345] \"starbucks.com.\"            \"starwoodhotels.com.\"       \"statestreet.com.\"          \"steelcase.com.\"           \r\n## [349] \"steeldynamics.com.\"        \"stericycle.com.\"           \"stifel.com.\"               \"stryker.com.\"             \r\n## [353] \"sunedison.com.\"            \"sungard.com.\"              \"supervalu.com.\"            \"symantec.com.\"            \r\n## [357] \"symantec.com.\"             \"synnex.com.\"               \"synopsys.com.\"             \"taylormorrison.com.\"      \r\n## [361] \"tdsinc.com.\"               \"teamhealth.com.\"           \"techdata.com.\"             \"teledyne.com.\"            \r\n## [365] \"tempursealy.com.\"          \"tenethealth.com.\"          \"teradata.com.\"             \"tetratech.com.\"           \r\n## [369] \"textron.com.\"              \"thermofisher.com.\"         \"tiaa-cref.org.\"            \"tiffany.com.\"             \r\n## [373] \"timewarner.com.\"           \"towerswatson.com.\"         \"treehousefoods.com.\"       \"tribunemedia.com.\"        \r\n## [377] \"trimble.com.\"              \"trinet.com.\"               \"trueblue.com.\"             \"ugicorp.com.\"             \r\n## [381] \"uhsinc.com.\"               \"ulta.com.\"                 \"unifiedgrocers.com.\"       \"unisys.com.\"              \r\n## [385] \"unum.com.\"                 \"usfoods.com.\"              \"varian.com.\"               \"verizon.com.\"             \r\n## [389] \"vfc.com.\"                  \"viacom.com.\"               \"visa.com.\"                 \"vishay.com.\"              \r\n## [393] \"visteon.com.\"              \"wabtec.com.\"               \"walmart.com.\"              \"wecenergygroup.com.\"      \r\n## [397] \"wecenergygroup.com.\"       \"west.com.\"                 \"westarenergy.com.\"         \"westlake.com.\"            \r\n## [401] \"westrock.com.\"             \"weyerhaeuser.com.\"         \"wholefoodsmarket.com.\"     \"williams.com.\"            \r\n## [405] \"wm.com.\"                   \"wnr.com.\"                  \"wpxenergy.com.\"            \"wyndhamworldwide.com.\"    \r\n## [409] \"xerox.com.\"                \"xpo.com.\"                  \"yrcw.com.\"                 \"yum.com.\"                 \r\n## [413] \"zoetis.com.\"<\/pre>\n
And, even go so far as to see what are the most popular third-party mail services:<\/p>\n
incl <- suffix_extract(sort(unlist(spf_includes(f1k$data))))\r\nincl <- data.frame(table(paste(incl$domain, incl$suffix, sep=\".\")), stringsAsFactors=FALSE)\r\nincl <- head(arrange(incl, desc(Freq)), 20)\r\nincl <- mutate(incl, Var1=factor(Var1, Var1))\r\nincl <- rename(incl, Service=Var1, Count=Freq)\r\n\r\ngg <- ggplot(incl, aes(Service, Count))\r\ngg <- gg + geom_bar(stat=\"identity\", width=0.75)\r\ngg <- gg + scale_x_discrete(expand=c(0,0))\r\ngg <- gg + scale_y_continuous(expand=c(0,0), limits=c(0, 250))\r\ngg <- gg + coord_flip()\r\ngg <- gg + labs(x=NULL, y=NULL, \r\n                title=\"Most popular services used by the F1000\",\r\n                subtitle=\"As determined by SPF record configuration\")\r\ngg <- gg + theme_hrbrmstr(grid=\"X\", axis=\"y\")\r\ngg <- gg + theme(plot.margin=margin(t=10, l=10, b=20, r=10))\r\ngg<\/pre>\n
\"Fullscreen_4_11_16__1_10_AM\"<\/a><\/p>\n
### Fin<\/p>\n
There are more `TXT` records to play with than just SPF ones and many other hidden easter eggs. I need to add a few more functions into `gdns` before shipping it off to CRAN, so if you have any feature requests, now's the time to file a [github issue](https:\/\/github.com\/hrbrmstr\/gdns\/issues). <\/p>\n","protected":false},"excerpt":{"rendered":"
Google recently [announced](https:\/\/developers.google.com\/speed\/public-dns\/docs\/dns-over-https) their DNS-over-HTTPS API, which _”enhances privacy and security between a client and a recursive resolver, and complements DNSSEC to provide end-to-end authenticated DNS lookups”_. The REST API they provided was pretty simple to [wrap into a package](https:\/\/github.com\/hrbrmstr\/gdns) and I tossed in some [SPF](http:\/\/www.openspf.org\/SPF_Record_Syntax) functions that I had lying around to bulk it […]<\/p>\n","protected":false},"author":1,"featured_media":4276,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":3,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"","footnotes":""},"categories":[760,681,74,3,91,646],"tags":[810],"class_list":["post-4267","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-apis","category-cybersecurity","category-dns","category-information-security","category-r","category-security-awareness","tag-post"],"yoast_head":"\nClandestine DNS lookups with gdns - rud.is<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Clandestine DNS lookups with gdns - rud.is\" \/>\n<meta property=\"og:description\" content=\"Google recently [announced](https:\/\/developers.google.com\/speed\/public-dns\/docs\/dns-over-https) their DNS-over-HTTPS API, which _”enhances privacy and security between a client and a recursive resolver, and complements DNSSEC to provide end-to-end authenticated DNS lookups”_. The REST API they provided was pretty simple to [wrap into a package](https:\/\/github.com\/hrbrmstr\/gdns) and I tossed in some [SPF](http:\/\/www.openspf.org\/SPF_Record_Syntax) functions that I had lying around to bulk it […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/\" \/>\n<meta property=\"og:site_name\" content=\"rud.is\" \/>\n<meta property=\"article:published_time\" content=\"2016-04-11T05:25:58+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-03-07T21:42:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2016\/04\/Fullscreen_4_11_16__1_10_AM.png?fit=1173%2C1013&ssl=1\" \/>\n\t<meta property=\"og:image:width\" content=\"1173\" \/>\n\t<meta property=\"og:image:height\" content=\"1013\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"hrbrmstr\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"hrbrmstr\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/\"},\"author\":{\"name\":\"hrbrmstr\",\"@id\":\"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886\"},\"headline\":\"Clandestine DNS lookups with gdns\",\"datePublished\":\"2016-04-11T05:25:58+00:00\",\"dateModified\":\"2018-03-07T21:42:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/\"},\"wordCount\":732,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886\"},\"image\":{\"@id\":\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2016\/04\/Fullscreen_4_11_16__1_10_AM.png?fit=1173%2C1013&ssl=1\",\"keywords\":[\"post\"],\"articleSection\":[\"APIs\",\"Cybersecurity\",\"DNS\",\"Information Security\",\"R\",\"Security Awareness\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/\",\"url\":\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/\",\"name\":\"Clandestine DNS lookups with gdns - rud.is\",\"isPartOf\":{\"@id\":\"https:\/\/rud.is\/b\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2016\/04\/Fullscreen_4_11_16__1_10_AM.png?fit=1173%2C1013&ssl=1\",\"datePublished\":\"2016-04-11T05:25:58+00:00\",\"dateModified\":\"2018-03-07T21:42:45+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#primaryimage\",\"url\":\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2016\/04\/Fullscreen_4_11_16__1_10_AM.png?fit=1173%2C1013&ssl=1\",\"contentUrl\":\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2016\/04\/Fullscreen_4_11_16__1_10_AM.png?fit=1173%2C1013&ssl=1\",\"width\":1173,\"height\":1013},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/rud.is\/b\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Clandestine DNS lookups with gdns\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/rud.is\/b\/#website\",\"url\":\"https:\/\/rud.is\/b\/\",\"name\":\"rud.is\",\"description\":\""In God we trust. All others must bring data"\",\"publisher\":{\"@id\":\"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/rud.is\/b\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886\",\"name\":\"hrbrmstr\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1\",\"url\":\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1\",\"contentUrl\":\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1\",\"width\":460,\"height\":460,\"caption\":\"hrbrmstr\"},\"logo\":{\"@id\":\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1\"},\"description\":\"Don't look at me\u2026I do what he does \u2014 just slower. #rstats avuncular \u2022 ?Resistance Fighter \u2022 Cook \u2022 Christian \u2022 [Master] Chef des Donn\u00e9es de S\u00e9curit\u00e9 @ @rapid7\",\"sameAs\":[\"http:\/\/rud.is\"],\"url\":\"https:\/\/rud.is\/b\/author\/hrbrmstr\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Clandestine DNS lookups with gdns - rud.is","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/","og_locale":"en_US","og_type":"article","og_title":"Clandestine DNS lookups with gdns - rud.is","og_description":"Google recently [announced](https:\/\/developers.google.com\/speed\/public-dns\/docs\/dns-over-https) their DNS-over-HTTPS API, which _”enhances privacy and security between a client and a recursive resolver, and complements DNSSEC to provide end-to-end authenticated DNS lookups”_. The REST API they provided was pretty simple to [wrap into a package](https:\/\/github.com\/hrbrmstr\/gdns) and I tossed in some [SPF](http:\/\/www.openspf.org\/SPF_Record_Syntax) functions that I had lying around to bulk it […]","og_url":"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/","og_site_name":"rud.is","article_published_time":"2016-04-11T05:25:58+00:00","article_modified_time":"2018-03-07T21:42:45+00:00","og_image":[{"width":1173,"height":1013,"url":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2016\/04\/Fullscreen_4_11_16__1_10_AM.png?fit=1173%2C1013&ssl=1","type":"image\/png"}],"author":"hrbrmstr","twitter_card":"summary_large_image","twitter_misc":{"Written by":"hrbrmstr","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#article","isPartOf":{"@id":"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/"},"author":{"name":"hrbrmstr","@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"headline":"Clandestine DNS lookups with gdns","datePublished":"2016-04-11T05:25:58+00:00","dateModified":"2018-03-07T21:42:45+00:00","mainEntityOfPage":{"@id":"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/"},"wordCount":732,"commentCount":1,"publisher":{"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"image":{"@id":"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2016\/04\/Fullscreen_4_11_16__1_10_AM.png?fit=1173%2C1013&ssl=1","keywords":["post"],"articleSection":["APIs","Cybersecurity","DNS","Information Security","R","Security Awareness"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/","url":"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/","name":"Clandestine DNS lookups with gdns - rud.is","isPartOf":{"@id":"https:\/\/rud.is\/b\/#website"},"primaryImageOfPage":{"@id":"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#primaryimage"},"image":{"@id":"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2016\/04\/Fullscreen_4_11_16__1_10_AM.png?fit=1173%2C1013&ssl=1","datePublished":"2016-04-11T05:25:58+00:00","dateModified":"2018-03-07T21:42:45+00:00","breadcrumb":{"@id":"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#primaryimage","url":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2016\/04\/Fullscreen_4_11_16__1_10_AM.png?fit=1173%2C1013&ssl=1","contentUrl":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2016\/04\/Fullscreen_4_11_16__1_10_AM.png?fit=1173%2C1013&ssl=1","width":1173,"height":1013},{"@type":"BreadcrumbList","@id":"https:\/\/rud.is\/b\/2016\/04\/11\/clandestine-dns-lookups-with-gdns\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/rud.is\/b\/"},{"@type":"ListItem","position":2,"name":"Clandestine DNS lookups with gdns"}]},{"@type":"WebSite","@id":"https:\/\/rud.is\/b\/#website","url":"https:\/\/rud.is\/b\/","name":"rud.is","description":""In God we trust. All others must bring data"","publisher":{"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/rud.is\/b\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886","name":"hrbrmstr","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","url":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","contentUrl":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","width":460,"height":460,"caption":"hrbrmstr"},"logo":{"@id":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1"},"description":"Don't look at me\u2026I do what he does \u2014 just slower. #rstats avuncular \u2022 ?Resistance Fighter \u2022 Cook \u2022 Christian \u2022 [Master] Chef des Donn\u00e9es de S\u00e9curit\u00e9 @ @rapid7","sameAs":["http:\/\/rud.is"],"url":"https:\/\/rud.is\/b\/author\/hrbrmstr\/"}]}},"jetpack_featured_media_url":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2016\/04\/Fullscreen_4_11_16__1_10_AM.png?fit=1173%2C1013&ssl=1","jetpack_shortlink":"https:\/\/wp.me\/p23idr-16P","jetpack_likes_enabled":true,"jetpack-related-posts":[{"id":9386,"url":"https:\/\/rud.is\/b\/2018\/04\/01\/more-options-for-querying-dns-from-r-with-1-1-1-1\/","url_meta":{"origin":4267,"position":0},"title":"More Options For Querying DNS From R with 1.1.1.1","author":"hrbrmstr","date":"2018-04-01","format":false,"excerpt":"You have to have been living under a rock to not know about Cloudflare's new 1.1.1.1 DNS offering. I won't go into \"privacy\", \"security\" or \"speed\" concepts in this post since that's a pretty huge topic to distill for folks given the, now, plethora of confusing (and pretty technical) options\u2026","rel":"","context":"In "DNS"","block_context":{"text":"DNS","link":"https:\/\/rud.is\/b\/category\/dns\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":12225,"url":"https:\/\/rud.is\/b\/2019\/05\/26\/two-new-ways-to-make-dns-over-https-queries-in-r\/","url_meta":{"origin":4267,"position":1},"title":"Two New Ways to Make DNS over HTTPS Queries in R","author":"hrbrmstr","date":"2019-05-26","format":false,"excerpt":"A fair bit of time ago the {gdns} package made its way to CRAN to give R users the ability to use Google's (at that time) nascent support for DNS over HTTPS (DoH). A bit later on Cloudflare also provided a global DoH endpoint and that begat the (not-on-CRAN) {dnsflare}\u2026","rel":"","context":"In "DNS"","block_context":{"text":"DNS","link":"https:\/\/rud.is\/b\/category\/dns\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2969,"url":"https:\/\/rud.is\/b\/2014\/04\/25\/moving-from-system-calls-to-rcpp-interfaces\/","url_meta":{"origin":4267,"position":2},"title":"Moving From system() calls to Rcpp Interfaces","author":"hrbrmstr","date":"2014-04-25","format":false,"excerpt":"Over on the [Data Driven Security Blog](http:\/\/datadrivensecurity.info\/blog\/posts\/2014\/Apr\/making-better-dns-txt-record-lookups-with-rcpp\/) there's a post on how to use `Rcpp` to interface with an external library (in this case `ldns` for DNS lookups). It builds on [another post](http:\/\/datadrivensecurity.info\/blog\/posts\/2014\/Apr\/firewall-busting-asn-lookups\/) which uses `system()` to make a call to `dig` to lookup DNS `TXT` records. The core code\u2026","rel":"","context":"In "Information Security"","block_context":{"text":"Information Security","link":"https:\/\/rud.is\/b\/category\/information-security\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2564,"url":"https:\/\/rud.is\/b\/2013\/08\/12\/reverse-ip-address-lookups-with-r-from-simple-to-bulkasynchronous\/","url_meta":{"origin":4267,"position":3},"title":"Reverse IP Address Lookups With R (From Simple To Bulk\/Asynchronous)","author":"hrbrmstr","date":"2013-08-12","format":false,"excerpt":"R lacks some of the more \"utilitarian\" features found in other scripting languages that were\/are more geared\u2014at least initially\u2014towards systems administration. One of the most frustrating missing pieces for security data scientists is the lack of ability to perform basic IP address manipulations, including reverse DNS resolution (even though it\u2026","rel":"","context":"In "Data Analysis"","block_context":{"text":"Data Analysis","link":"https:\/\/rud.is\/b\/category\/data-analysis-2\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":129,"url":"https:\/\/rud.is\/b\/2011\/02\/14\/metricon-name-server-log-data\/","url_meta":{"origin":4267,"position":4},"title":"Metricon: Name Server Log Data","author":"hrbrmstr","date":"2011-02-14","format":false,"excerpt":"Speakers: Fruhwirth, Proschinger, Lendl, Savola \"On the use of name server log data as input for security measurements\" \u00a0 CERT.at ERT coordinate sec efforts & inc resp for IT sec prblms on a national level in Austria constituted of IT company security teams and local CERTs \u00a0 Why name server\u2026","rel":"","context":"In "Information Security"","block_context":{"text":"Information Security","link":"https:\/\/rud.is\/b\/category\/information-security\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":633,"url":"https:\/\/rud.is\/b\/2011\/11\/14\/dnschanger-detector\/","url_meta":{"origin":4267,"position":5},"title":"DNSChanger Detector","author":"hrbrmstr","date":"2011-11-14","format":false,"excerpt":"The FBI made a tool to help you determine if you were a victim of the DNSChanger malware. If you're like many casual Internet users, you have no idea how to get the information to plug into the input box. Unfortunately, the security model of most modern browsers makes it\u2026","rel":"","context":"In "Browsers"","block_context":{"text":"Browsers","link":"https:\/\/rud.is\/b\/category\/browsers\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/4267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/comments?post=4267"}],"version-history":[{"count":0,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/4267\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/media\/4276"}],"wp:attachment":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/media?parent=4267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/categories?post=4267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/tags?post=4267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}