What Are Some Ways to Secure a DNS Server Against Attack?
Domain Name System, DNS for short, is a hierarchical naming system that translates domain name addresses that humans understand into numerical language that computers understand. DNS then searches and finds the user's requested address. DNS servers are the heart of all networks and need to be protected against malicious and even accidental damage done by users. Configuring firewalls, forwarders, zone transfers and resolvers are a few ways to protect DNS servers.
Other People Are Reading
-
DNS Forwarders
-
A DNS forwarder is a DNS server that performs queries for another DNS server and lessens traffic on the main DNS server. DNS forwarders can have much larger caches, which benefits the primary DNS server. A forwarder also prevents the primary DNS server from contacting servers outside the internal network. This is beneficial to the security of the DNS server and internal network.
Firewalls
-
Firewalls are a security necessity that restricts unauthorized access to systems and networks, and are one of the strongest lines of defense against attacks from outside users. Firewalls are installed using software or are integrated by default into networking hardware such as routers. Firewalls can filter TCP/IP traffic, ports and protocols. Firewalls can be configured to be lenient or aggressive when accepting incoming traffic.
-
Disable Zone Transfers
-
Zone transfers occur between the primary and secondary DNS servers. DNS zone files are created and updated by the primary server, and a read-only copy is sent to the secondary server. Disabling this is a must because malicious users can request the zone files on the primary server to be dumped. The attacker can then alter the naming schema and damage network infrastructures. Denying all zone transfers or only allowing specific servers halts these attacks.
DNS Resolvers
-
A DNS resolver is a DNS server that resolves domain names without being an authoritative or primary server. A DNS resolver server's only job is to resolve host names for the end user. A resolver can be available for users within an internal network, for outside users, or both. It also lessens the load of authoritative and primary servers.
-
References
- Photo Credit Thinkstock Images/Comstock/Getty Images
