Principles of Information Security: DNS Security and DNSSEC

DNS Security and DNSSEC

DNS Security & DNSSEC: Exam-Ready Study Guide

What This Is

The Domain Name System (DNS) is the internet’s phonebook—translating human-readable domain names (e.g., google.com) into machine-readable IP addresses (e.g., 172.217.3.110). Without DNS, the internet as we know it wouldn’t function. However, DNS was designed in the 1980s with no built-in security, making it a prime target for attacks like cache poisoning, spoofing, and DDoS amplification. A real-world example: In 2016, the Mirai botnet exploited vulnerable DNS servers to launch a 620 Gbps DDoS attack against Dyn, taking down major sites like Twitter, Netflix, and Reddit. DNSSEC (DNS Security Extensions) was created to add cryptographic integrity to DNS responses, ensuring users reach the correct website and not a malicious imposter.

Key Terms & Concepts

• DNS (Domain Name System):
  Hierarchical, distributed database that resolves domain names to IP addresses. Operates on UDP port 53 (mostly) and TCP port 53 (for large responses, e.g., zone transfers).
  Standards: IETF RFCs (e.g., RFC 1035 for DNS, RFC 4033-4035 for DNSSEC).

• DNSSEC (DNS Security Extensions):
  A suite of IETF extensions that digitally signs DNS records to prevent spoofing and tampering. Uses public-key cryptography (RSA/ECDSA) to ensure data integrity and authenticity.
  Key Tools: dig +dnssec, dnssec-keygen, BIND (DNS server software).

• Zone File:
  A text file containing DNS records for a domain (e.g., A, AAAA, MX, NS records). Stored on authoritative DNS servers.
  Example: example.com. IN A 192.0.2.1 example.com. IN MX 10 mail.example.com.

• Authoritative DNS Server:
  The "source of truth" for a domain’s DNS records. Only it can provide signed (DNSSEC) responses for its zone.
  Example: Cloudflare’s 1.1.1.1 is a recursive resolver, not authoritative for google.com.

• Recursive DNS Resolver:
  A server (e.g., ISP’s DNS, Google’s 8.8.8.8) that queries authoritative servers on behalf of clients and caches responses.
  Security Risk: Vulnerable to cache poisoning if not secured.

• DNS Cache Poisoning (Kaminsky Attack):
  An attack where an attacker injects fake DNS records into a resolver’s cache, redirecting users to malicious sites.
  Example: In 2008, Dan Kaminsky demonstrated how attackers could poison caches by exploiting predictable transaction IDs in DNS queries.

• DNS Spoofing (Pharming):
  Redirecting users to a fake website by forging DNS responses. Unlike phishing (which tricks users into clicking links), pharming automatically redirects victims.
  Example: Attackers compromise a router’s DNS settings to redirect bankofamerica.com to a fake login page.

• DNS Tunneling:
  Abusing DNS queries to exfiltrate data or bypass firewalls. Attackers encode data in DNS requests (e.g., stolendata.example.com).
  Detection Tools: dnscat2, iodine, Security Onion (for monitoring unusual DNS traffic).

• DDoS Amplification Attack:
  Attackers send small DNS queries with a spoofed source IP (the victim’s) to open DNS resolvers, which respond with large replies, overwhelming the victim.
  Example: A 60-byte query can trigger a 4,000-byte response (amplification factor of ~66x).

• RRSIG (Resource Record Signature):
  A DNSSEC record containing a digital signature for a DNS record set (e.g., all A records for example.com). Proves the record hasn’t been tampered with.

• DS (Delegation Signer) Record:
  A record in the parent zone (e.g., .com) that points to the public key of a child zone (e.g., example.com). Enables chain of trust in DNSSEC.

• NSEC/NSEC3 (Next Secure Record):
  DNSSEC records that prove a domain doesn’t exist (preventing "zone walking" attacks). NSEC3 uses hashed names for privacy.
  Example: If nonexistent.example.com is queried, NSEC3 proves it doesn’t exist without revealing other domains.

• DNS over HTTPS (DoH) / DNS over TLS (DoT):
  Encrypts DNS traffic to prevent eavesdropping and tampering. DoH uses HTTPS (port 443), while DoT uses TLS (port 853).
  Tools: Cloudflare’s 1.1.1.1, Google’s 8.8.8.8, Firefox (DoH by default).

Step-by-Step: Securing DNS with DNSSEC

1. Assess DNS Vulnerabilities

• Check for open resolvers: Use nmap -sU -p 53 <IP> to see if a DNS server responds to queries from anywhere (bad!).
• Test for cache poisoning: Use dig +short porttest.dns-oarc.net TXT to check if your resolver uses randomized source ports (mitigates Kaminsky attacks).
• Verify DNSSEC support: Run dig +dnssec example.com and look for ad (Authenticated Data) flag in the response.

2. Enable DNSSEC on Authoritative Servers

• Generate keys:
  bash dnssec-keygen -a RSASHA256 -b 2048 -n ZONE example.com # KSK (Key Signing Key) dnssec-keygen -a RSASHA256 -b 1024 -n ZONE example.com # ZSK (Zone Signing Key)
• Sign the zone:
  bash dnssec-signzone -A -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) -N INCREMENT -o example.com -t example.com.zone
• Publish DS record: Submit the KSK’s public key hash to your domain registrar (e.g., GoDaddy, Cloudflare) to create a DS record in the parent zone.

3. Configure Recursive Resolvers to Validate DNSSEC

• BIND (named.conf):
  plaintext options {
dnssec-validation auto;
dnssec-enable yes; };
• Unbound (unbound.conf):
  plaintext server:
module-config: "validator iterator"
• Test validation: Run dig +dnssec sigfail.verteiltesysteme.net (should return SERVFAIL if DNSSEC validation works).

4. Monitor and Maintain DNSSEC

• Automate key rollovers: Use dnssec-keygen -K to schedule ZSK rollovers (e.g., every 3 months) and KSK rollovers (e.g., every 2 years).
• Monitor for failures: Set up alerts for SERVFAIL responses (indicates DNSSEC validation errors).
• Use DNSSEC-trigger: A tool to check if your resolver validates DNSSEC correctly.

5. Deploy DoH/DoT for Privacy

• Configure DoH in Firefox:
  Settings > Network Settings > Enable DNS over HTTPS (use Cloudflare or NextDNS).
• Set up DoT on a router:
  Use stubby or dnsdist to forward DNS queries over TLS to a secure resolver (e.g., 1.1.1.1:853).

6. Harden Against DDoS and Tunneling

• Rate limiting: Use iptables or nftables to limit DNS queries per IP.
• Block large responses: Configure firewalls to drop DNS responses > 512 bytes (unless EDNS0 is used).
• Monitor for tunneling: Use SIEM tools (Splunk, ELK) to detect unusual DNS query patterns (e.g., long subdomains, high volume).

Common Mistakes

Mistake 1: Thinking DNSSEC Encrypts DNS Traffic

• Correction: DNSSEC only ensures integrity and authenticity, not confidentiality. For encryption, use DoH/DoT.

Mistake 2: Forgetting to Roll Keys

• Correction: DNSSEC keys must be rotated (ZSK every 3 months, KSK every 2 years). Failing to do so can break DNS resolution when keys expire.

Mistake 3: Not Publishing DS Records

• Correction: After signing a zone, you must submit the DS record to your registrar. Without it, the chain of trust is broken, and DNSSEC validation fails.

Mistake 4: Using Weak Cryptography (e.g., RSA-1024)

• Correction: Use RSA-2048+ or ECDSA (P-256/P-384) for keys. Weak keys can be brute-forced.

Mistake 5: Ignoring NSEC3 Opt-Out

• Correction: If your zone has many unsigned delegations, enable NSEC3 opt-out to reduce zone size and improve performance.

Certification Exam Tips

CISSP

• Focus on governance: Know that DNSSEC is required for federal agencies (NIST SP 800-81-2) and how it aligns with FISMA compliance.
• Risk management: Understand that DNSSEC mitigates cache poisoning but doesn’t prevent DDoS or tunneling.
• Tricky question: "Which DNSSEC record proves a domain doesn’t exist?" → NSEC/NSEC3.

Security+

• Port numbers: Memorize UDP 53 (DNS), TCP 53 (zone transfers), 853 (DoT), 443 (DoH).
• Attack types: Know the difference between DNS spoofing (pharming) and DNS tunneling (data exfiltration).
• Exam trap: "Which protocol encrypts DNS queries?" → DoT/DoH (not DNSSEC).

CEH

• Hands-on tools: Be familiar with dnscat2, iodine, and dig +dnssec.
• Attack scenarios: Know how to poison a cache (predict transaction IDs) and bypass DNSSEC (e.g., downgrade attacks).
• Defense: Understand response rate limiting (RRL) to mitigate DDoS.

Quick Check Questions

Question 1

A security analyst notices that users are being redirected to a fake banking site when typing mybank.com. The DNS resolver’s cache contains an incorrect A record for mybank.com. Which attack is most likely occurring? A) DNS tunneling B) DNS cache poisoning C) DNS amplification D) DNSSEC validation failure

✅ Correct Answer: B) DNS cache poisoning
Explanation: Cache poisoning involves injecting fake DNS records into a resolver’s cache, redirecting users to malicious sites.

Question 2

An organization wants to ensure that DNS responses are not tampered with in transit. Which of the following provides integrity but not confidentiality? A) DNS over TLS (DoT) B) DNSSEC C) DNS over HTTPS (DoH) D) DNSCrypt

✅ Correct Answer: B) DNSSEC
Explanation: DNSSEC uses digital signatures to ensure integrity and authenticity, but it does not encrypt DNS traffic (unlike DoT/DoH).

Question 3

During a penetration test, an attacker encodes stolen data in DNS queries to evil.com. Which technique is being used? A) DNS spoofing B) DNS tunneling C) DNS amplification D) DNSSEC downgrade

✅ Correct Answer: B) DNS tunneling
Explanation: DNS tunneling abuses DNS queries to exfiltrate data or bypass firewalls by encoding data in subdomains.

Last-Minute Cram Sheet

1. DNSSEC = Integrity + Authenticity (not encryption). Uses RRSIG, DS, DNSKEY records.
2. DoH (DNS over HTTPS) = Port 443, DoT (DNS over TLS) = Port 853 (both encrypt DNS).
3. DNS cache poisoning = Attacker injects fake records into resolver cache (mitigated by DNSSEC + random transaction IDs).
4. DNS amplification = Small query → large response (DDoS). Mitigate with rate limiting + response size limits.
5. KSK (Key Signing Key) = Long-term key (2+ years), ZSK (Zone Signing Key) = Short-term (3-6 months).
6. NSEC/NSEC3 = Proves a domain doesn’t exist (NSEC3 uses hashed names for privacy).
7. DS record = Published in parent zone to establish chain of trust in DNSSEC.
8. DNS tunneling = Data exfiltration via DNS queries (detect with SIEM + unusual query patterns).
9. ⚠️ Exam Trap: DNSSEC does not prevent DDoS or phishing—only spoofing/tampering.
10. Ports: UDP 53 (DNS), TCP 53 (zone transfers), 853 (DoT), 443 (DoH).