Rolling out the fix for unwanted popups to billing counter computers across Multiple Stores With MITM-DNS

7-minute read • homemadesoftware.net

The hosts-file fix in our last post worked well for the one shop we built it for. Then the customer asked for the same protection across every laptop, in every one of their stores. That's when a one-line hosts-file edit stopped being a solution and started being a chore.

Why hosts-file edits don't scale

Editing /etc/hosts is a five-minute job on one machine. Across a growing fleet of laptops spread over multiple stores, it turns into an ongoing liability:

• Every device, by hand: Someone with admin rights has to physically open the file on each laptop, in each store, and add the line correctly.
• No inventory: There's no central record of which machines have been patched and which haven't, so it's easy to miss one.
• New and replaced hardware: Every laptop the customer buys or swaps in later starts out unprotected until someone remembers to edit it too.
• No remote updates: If the vendor ever changes the popup's domain, every single hosts file needs to be touched again.

What we needed instead was one place to make the change that every device, in every store, would automatically respect.

mitm-dns: a DNS server we control

We already run mitm-dns, a lightweight DNS server we built for exactly this kind of override. It's a custom resolver driven by a single JSON config file: it answers the domains we've explicitly listed, and forwards everything else upstream to normal public DNS resolvers so regular browsing is unaffected.

Point a device at it as its DNS server and it behaves like any other DNS server, except for the handful of domains we've told it to override.

Pointing the popup domain to a dead IP

Instead of editing a hosts file on each machine, we added one entry to the DNS server's config, once:

This tells the server that any request for feedback.salesdomain.com should resolve to 0.0.0.0, a non-routable address that fails instantly, instead of the vendor's real server. Every other domain on the internet is still forwarded normally through forward_to. The server picks the change up automatically, no restart needed.

Wiring it into the network

The config change was the easy part. The bigger win was getting every device to use this server without touching them one by one:

DNS resolution, before and after

Querying the popup's domain against the vendor's real DNS still resolves normally:

But once a device is using our DNS server, the exact same lookup resolves differently:

Same domain, same device — different answer, because the DNS server it's asking has been told to override this one name and forward everything else honestly.

Why this is the better long-term fix

• One change, every store: A single edit to one JSON file protects every device on every store network within seconds.
• New devices are covered automatically: Any laptop the customer adds later inherits the block the moment it joins the store network — no setup checklist required.
• Centrally managed: If the vendor changes their domain or the popup moves, we update the block in one place instead of chasing down every machine again.
• Nothing else breaks: Only the domains we've explicitly listed are overridden. Every other request is forwarded normally, so day-to-day browsing and the rest of the sales software work exactly as before.