OpenWRT One: FIX: "possible DNS-rebind attack detected"

Banana Pi Router design OpenWRT One(MT7981)/BPI-R2 Mini
1

If you’re getting logspam every 15 seconds something like this:

daemon.warn: dnsmasq[1]: possible DNS-rebind attack detected: dns.msftncsi.com

… that’s the Windows Network Connectivity Status Indicator (NCSI)… block that traffic, and your Windows machines will report that they don’t have internet access (even if they do).

It’s especially bad if you’ve got lots of Windows machines… they’ll fill your logs with that logspam.

The standard resolution is to put dns.msftncsi.com in Network >> DNS >> Filter >> Domain whitelist. But I don’t consider dropping DNS rebind protection for Microsoft to be a ‘resolution’.

So I hijack those DNS requests and service them via the router, so they never reach the internet:

In Network >> DNS >> DNS Records >> Hostnames, I’ve created two entries:

  • dns.msftncsi.com as the Hostname, and 131.107.255.255 as the IP address
  • dns.msftncsi.com as the Hostname, and fd3e:4f5a:5b81::1 as the IP address

Now, from your computer, issue:

dig dns.msftncsi.com AAAA

… which should return something like:

; <<>> DiG 9.18.39-0ubuntu0.24.04.3-Ubuntu <<>> dns.msftncsi.com AAAA
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3806
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;dns.msftncsi.com.		IN	AAAA

;; ANSWER SECTION:
dns.msftncsi.com.	7194	IN	AAAA	fd3e:4f5a:5b81::1

;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Wed Oct 28 21:44:08 CDT 2026
;; MSG SIZE  rcvd: 73

Note the:

;; Query time: 0 msec

Now, from your computer, issue:

dig dns.msftncsi.com

… which should return something like:

; <<>> DiG 9.18.39-0ubuntu0.24.04.3-Ubuntu <<>> dns.msftncsi.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53617
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;dns.msftncsi.com.		IN	A

;; ANSWER SECTION:
dns.msftncsi.com.	3395	IN	A	131.107.255.255

;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Wed Oct 28 21:31:15 CDT 2026
;; MSG SIZE  rcvd: 61

Note the:

;; Query time: 0 msec

Now, from your router (via ssh), issue:

dig dns.msftncsi.com AAAA

… which should return something like:

; <<>> DiG 9.20.30 <<>> dns.msftncsi.com AAAA
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57431
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;dns.msftncsi.com.		IN	AAAA

;; ANSWER SECTION:
dns.msftncsi.com.	43200	IN	AAAA	fd3e:4f5a:5b81::1

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Wed Oct 28 21:48:52 CDT 2026
;; MSG SIZE  rcvd: 73

Note the:

;; Query time: 0 msec

And finally, from your router (via ssh), issue:

dig dns.msftncsi.com

… which should return something like:

; <<>> DiG 9.20.30 <<>> dns.msftncsi.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6705
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;dns.msftncsi.com.		IN	A

;; ANSWER SECTION:
dns.msftncsi.com.	43200	IN	A	131.107.255.255

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Wed Oct 28 21:50:36 CDT 2026
;; MSG SIZE  rcvd: 61

Note the:

;; Query time: 0 msec

That means that traffic never got a chance to get out to the internet, the router returned the answer.

Now your Windows machines should happily report that they have internet access, and your router won’t have the ‘possible DNS-rebind attack detected’ logspam.