DNS Spoofing

DNS Spoofing tells Cloak Proxy to connect to a different IP address for a host name, without changing anything else. The URL, the Host header and the TLS server name all stay the same, so the request looks exactly as before; it just reaches another machine. Use it to test a new server or a load balancer before you switch DNS, or to send a production host name to a server on your Mac.

Point a host at another address

1. Choose Tools › Edit DNS Spoofing Rules…, or right-click a request and choose Tools › DNS Spoofing… to add a row for its host.

2. Click Add if you need a new row. It starts with the address 127.0.0.1.

3. Type the host name in Host, for example api.example.com.

4. Type the address to connect to in IP address, for example 192.168.1.20.

5. Make sure the row’s On checkbox and the tool’s On switch are on. DNS Spoofing is on by default.

12345

DNS Spoofing is a simple table: one host and one address per row.

1. Turns this row on or off.
2. The host name, exactly as it appears in URLs.
3. The IP address to connect to instead.
4. Add a row (starts with 127.0.0.1).
5. Remove the selected row.

×

Columns and buttons

Control	What it does
On	Turns the row on or off.
Host	The host name to redirect. It’s matched exactly, ignoring case: api.example.com doesn’t cover cdn.example.com, and wildcards aren’t supported.
IP address	Where to connect instead, such as 127.0.0.1 or 192.168.1.20.
Add	Adds a row with an empty host and the address 127.0.0.1.
Remove	Deletes the selected row.

A row needs both a host and an address to take effect. If the same host appears in two enabled rows, the lower row wins.

What changes and what doesn’t

Part of the request	With DNS Spoofing
The IP address Cloak Proxy connects to	The address in the row.
The port	Unchanged. Use Map Remote to change it.
The URL and the Host header	Unchanged.
The TLS server name, and the host name the server’s certificate is checked against	Unchanged.

Because the certificate is still checked against the original host name, the server at the new address must present a valid certificate for that name. A local server with a self-signed certificate fails the check; add its host to the insecure upstream hosts in Network settings while you test.

What DNS Spoofing applies to

Unlike the other tools, DNS Spoofing applies to every connection Cloak Proxy makes for a host:

• HTTP requests, including decrypted HTTPS. These show a DNS Spoofing badge in the traffic list.
• HTTPS tunnels Cloak Proxy doesn’t decrypt.
• WebSocket connections.
• Requests that Map Remote sends to a new host: the spoofed address is looked up for the new host.
• Domains captured for apps that ignore the proxy: a DNS Spoofing row wins over the address Cloak Proxy looked up for them.

Note

DNS Spoofing doesn’t change your Mac’s DNS. Only traffic going through Cloak Proxy is affected; apps that don’t use the proxy still resolve the host normally, and so does ping in Terminal.

DNS Spoofing or Map Remote?

You want to	Use
Reach another machine with the same URL, Host header and certificate name	DNS Spoofing
Change the host name, port, scheme, path or query	Map Remote
Answer from your Mac without any server	Map Local

Caution

A forgotten DNS Spoofing row sends a real host to the wrong machine, and nothing in the URL shows it. Look for the DNS Spoofing chip in the status bar and remove rows you no longer need.

Related

Map RemoteChange the host, port, path or query of matching requests.

Network settingsInsecure upstream hosts, external proxies and more.

How Cloak Proxy worksTunnels, TLS interception and DNS capture.

Debugging toolsEvery tool and how to turn them on and off.