 Hello, Didier Stavens here with the seventh video on my DNS resolver tool and here we are going to look at the track command. Now a couple of years ago on the Envizo blog I wrote about Canary PDFs, PDFs that contain URLs and when you open them you can track people, you can track the opening of those PDFs because they contain an URI like here and it's actually not the HTTP request itself that we will track because Adobe Reader for example will not perform this request before the user accepts that this request is done but what Adobe Reader does without asking the user anything is doing a DNS request and that is what we are going to track. So let's take a look at the month page and here we have the track command, it requires a label which is mandatory, logging which is optional but if you want to do tracking here you typically want to do some logging and then the answer that you want to return and this is also optional but also better recommended. Unless you want to prevent for example Adobe Reader from trying to make an HTTP connection then you can leave the answer like this. This is an example here with label PDF and then you can do queries like this ID0 PDFexample.com so let's try this out. So the type of the command is track, the label that I'm going to use is canary, I will do logging and say log canary, that's the prefix of the log file and then let's also include an answer so dot internet type and a record and let's say that we answer 8888, let's say answer. Now we have space characters in here so need to put this inside double quotes and now our DNS server is running and then over here I can do a request with nslookup so you could do this by opening a specially crafted PDF that contains that URL but here again I'm going to use just nslookup. So we have no files here in the folder nslookup, I'm going to ask for an a record and let's start with canary, anything example dot com for example and direct this locally because that's where my DNS server is running. If you do this query you get an nxdomain and that is how it is programmed. So for the label itself you get an nxdomain and that is something that I explain here in my nvblog post this is important for getting this tracking with adobe reader working. We have a log file and it contains our request here. Let's do another request and here we are going to include an ID as a label prior to canary. Let's say this is our first canary document so let's call this doc1 and here we get the answer that we provide 8888 but let's look at the log file and here you can see that this was recorded. You can see from where it is coming so that's the DNS server actually that is doing the request so it's not the client IP that you will see but the DNS and here you have the identifier for the document.