DNS Security Made Easy: An Engineer's Handbook

What is DNS security?

DNS security is the protection and prevention of the domain name system against vulnerability and attacks by cybercriminals.

Why is DNS security important and is DNS a security risk?

When the internet was first created, it was mostly used for communication by a small number of people (e.g., the military and universities). But as popularity grew, more people began to use the internet for personal use. Because people can't readily memorize IP addresses, there was a need for an intuitive way to solve the problem. As a result, DNS was born. Its purpose was to make it simple to access the internet by supplying domain names that were mapped to their associated IP addresses.

When DNS protocol was created, little attention was paid to its security, which allowed the DNS traffic to move freely through network firewalls. By taking advantage of this vulnerability, malicious actors can create fake DNS records that lead users to fake websites or make them perform malicious actions. As a result, DNS security is an important focus.

Authoritative and recursive DNS

To better understand what authoritative and recursive DNS are, let's look at this scenario.

Let's say you want to access a website using a domain name on your web browser. There is a resolver on your device (called stub resolver) that checks its database to know if it has the requested domain. If the requested domain is not in its record, the stub resolver sends a query to another resolver on the internet called the recursive resolver (or caching nameserver).

A recursive resolver is a nameserver usually provided by an internet service provider or other service providers, such as Google. It first checks its cache to know if it has the domain name in question. If it doesn't, it then sends a query on behalf of the user program (web browser) to an authoritative nameserver to obtain the IP address of the requested domain. It then returns the address to the user.

An authoritative nameserver is a system that takes a domain name and responds with information about the resources in that zone. It is where the IP address and the domain name of a particular website are located.

Common DNS attacks

Denial of Service (DoS) attack

In a DoS attack, malicious actors overload an authoritative server with an excessive number of queries, making it impossible to use the server. The server then crashes because it is unable to respond to all of the queries. As a result, other users or servers that want to access that server will be denied the service.

Distributed DoS (DDoS) attack

DDoS is a more elaborate form of DoS. It involves using multiple systems to overload the targeted server with excessive queries. The malicious actor employs tens of thousands of computers to perform the task.

There are two main DDoS attack methodologies: amplification and reflection.

Cache poisoning or data spoofing

Cache poisoning, also known as data spoofing, is the process whereby a malicious actor injects a fake DNS entry into a DNS server. As a result, the user is sent to illicit resources (e.g., fake websites). Take, for example, a user who wants to access their financial websites. On the other side, an attacker has changed the DNS server so that when a user enters a domain name, they are redirected to the attacker's phony replica of the banking website. The attackers can then steal valuable information by prompting the user to input their credentials on the bogus websites.

Fast Flux

Attackers use Fast Flux to conceal their identity by using rapidly changing sensitive information to hide the source of the attack. It comes in two forms: single flux (which includes changing IP addresses simultaneously) and double flux (which involves constantly changing IP addresses and domain names).

What is DNSSEC?

Because DNS data is intended to be public and distributed over the internet, it is important to protect the data's confidentiality. Integrity, source authentication, and availability are the three main security goals for DNS.

DNSSEC is a series of extensions designed by the Internet Engineering Task Force to secure data exchange in the DNS. DNSSEC ensures the authenticity and integrity of DNS data by preventing applications from receiving forged or false DNS data. It works by using digital signatures to encrypt DNS data. The recursive resolver can tell if the information received from the authoritative server is authenticated by inspecting the digital signature.

The DNSSEC functions in this way: Each DNS zone has its own set of private and public keys. The zone owner signs the data with the private key and creates a digital signature over it. Any recursive resolver that wants to access the data will also need to know the public key to validate the data's authenticity. The recursive resolvers then authenticate the digital signature's validity before returning the DNS data to the user. The recursive resolvers reject the data if the signature does not validate, and then return an error to the user.

How to prevent a DNS attack

Configure your DNS to be as secure as possible. You can do this by using a random port instead of the standard port for DNS (i.e., UDP port 53). You can also achieve this by randomizing the query ID and the case letters of the domain names that need to be resolved.

Add more security to recursive DNS servers. By using access control such as DNS filtering (the technique ISP uses to prevent its network from online threats), DNSSEC, and other means, you can safeguard the recursive server from unauthorized access.

Keep your resolver safe and secure. Don't expose resolvers to the public; instead, limit them to the users using the network. This will prevent malicious actors from spoofing (altering) the nameserver.

Integrate DNSSEC into your operations to validate the integrity of your data. DNSSEC improves the security of DNS protocol, preventing applications from receiving forged or false DNS data.

Keep your DNS servers up to date. If you are using third party DNS servers for your operations ( like Google DNS, Cloudflare), you won't need to worry about updating the DNS server. If you run your own nameserver, however, you'll need to update it from time to time to get new security features and improve the performance of your DNS operations.

Enable DNS filtering. DNS filtering is a way to isolate a user from malicious websites. It allows a system administrator to block users from sites that are known to contain malicious information. If a user wants to access that site, the DNS server disconnects all communication immediately.