How Phone Calls Leak Into Public DNS

A researcher took over a slice of e164.arpa and began receiving call metadata — including hundreds of thousands of calls to military bases.

Dafallah Ibrahim

— 2 min read
Share

Every phone number on Earth has a domain name. Before some systems connect a call, they look that domain up in public DNS. This week a researcher who ended up running name servers for part of that namespace found out what pours in: hundreds of thousands of call attempts — including calls to military bases.

The post currently on Hacker News's front page is titled "I accidentally logged hundreds of thousands of phone calls to military bases." No exploit, no malware. Just DNS.

Why this matters

DNS queries are telemetry. Every lookup tells whoever receives it what you're about to do. We've seen this movie with TLS SNI leaks and OCSP fingerprinting; this is the same bug wearing a telco costume.

The namespace is e164.arpa — reverse DNS for phone numbers, standardized as ENUM (RFC 3761). Most developers have never heard of it, yet plenty of call-routing equipment still queries it, and the tree is patchily maintained. Orphaned branches become someone else's wiretap.

How it works

ENUM maps a number to a domain: take +1 415 555 0123, drop the plus, reverse the digits, append the suffix.

3.2.1.0.5.5.5.5.1.4.1.e164.arpa

A SIP gateway queries that name for NAPTR records, hoping to find an IP endpoint for the call. For most numbers the answer is NXDOMAIN — but the query already crossed public DNS to get there. If your servers are authoritative for the branch it lands on, you just learned the dialed number, the caller's resolver, and a timestamp. That's a call-detail record nobody approved sharing.

Dialed numbers barely repeat, so caches rarely absorb the interesting first lookup. The fresh queries — actual call attempts — are the ones that reach the top of the tree.

Where this helps

  • Audit your call stack. Asterisk, FreeSWITCH, and Kamailio all ship ENUM modules. If yours is enabled and you don't use it, turn it off — or point it at a resolver you control.
  • Watch DNS egress. If you're not a telco, any *.e164.arpa traffic leaving your network is a misconfigured device broadcasting dialed numbers. One resolver log rule finds it.
  • Metadata hygiene. Add this to the SNI/OCSP family when you reason about what your infrastructure reveals to the public internet.

Watch out

Ordinary mobile calls mostly never touch ENUM — this is SIP trunks, PBXes, and carrier interconnects, so don't panic about your phone. What you can observe is also a biased sample: only callers whose resolvers traverse public DNS toward that branch appear. And before you get ideas — logging other people's call metadata sits in murky legal territory. The lesson is the leak, not the log.

Try it yourself

Resolve any phone number's ENUM name and see what comes back:

N=14155550123
Q=$(echo "$N" | rev | sed 's/./&./g')e164.arpa
echo "$Q"
dig +short NAPTR "$Q"

Almost certainly empty — which is exactly the point. The lookup traveled public DNS anyway, and anyone on the path could have logged it.

TL;DR

  • What happened: name servers for part of e164.arpa received hundreds of thousands of dialed-number lookups, including calls to military bases.
  • Why it matters: call-routing gear broadcasts dialed numbers through public DNS — no exploit needed for a metadata leak.
  • Try today: check whether your network emits *.e164.arpa queries, then run the dig one-liner on your own number.

Read more