Extensions Extension Products
Extensions Extension Products
Extensions Extension Products

DNS Security


DNS Security

Learning Objectives

After reading this article you will be able to:

  • Understand what DNSSEC is and how it works
  • Become familiar with the most common DNS attacks
  • Differentiate between DNSSEC and other DNS security solutions

Why is DNS security important?

Standard DNS queries, which are required for almost all web traffic, create opportunities for DNS exploits such as DNS hijacking and man-in-the-middle attacks. These attacks can redirect a website’s inbound traffic to a fake copy of the site, collecting sensitive user information and exposing businesses to major liability. One of the best known ways to protect against DNS threats is to adopt the DNSSEC protocol.


Like many internet protocols, the DNS system was not designed with security in mind and contains several design limitations. These limitations, combined with advances in technology, have made it easy for attackers to hijack a DNS lookup for malicious purposes, such as sending a user to a fraudulent website that can distribute malware or collect personal information. The DNS Security Extensions (DNSSEC) is a security protocol created to mitigate this problem. DNSSEC protects against attacks by digitally signing data to help ensure its validity. In order to ensure a secure lookup, the signing must happen at every level in the DNS lookup process.




DNSSEC creates a parent-child train of trust that travels all the way up to the root zone. This chain of trust cannot be compromised at any layer of DNS, otherwise the request will become open to a man-in-the-middle attack.



What are some common attacks involving DNS?

DNSSEC is a powerful security protocol, but unfortunately it is not currently universally adopted. This lack of adoption coupled with other potential vulnerabilities, on top of the fact that DNS is an integral part of most internet requests, makes the DNS a prime target for malicious attacks. Attackers have found a number of ways to target and exploit DNS servers, here’s some of the most common:




DNS Hijacking

NXDOMAIN attack: This is a type of DNS flood attack where an attacker inundates a DNS server with requests, asking for records that don’t exist, in an attempt to cause a denial-of-service for legitimate traffic. This can be accomplished using sophisticated attack tools which can auto-generate unique subdomains for each request. NXDOMAIN attacks can also target a recursive resolver with the goal of filling the resolver’s cache with junk requests.


Random subdomain attack: In this case, the attacker sends DNS queries for several random, non-existent subdomains of one legitimate site. The goal is to create a denial-of-service for the domain’s authoritative nameserver, making it impossible to lookup the website from the nameserver. As a side effect, the ISP serving the attacker may also be impacted, as their recursive resolver's cache will be loaded with bad requests.

Domain lock-up attack: Bad actors orchestrate this form of attack by setting up special domains and resolvers to create TCP connections with other legitimate resolvers. When the targeted resolvers send requests, these domains send back slow streams of random packets, tying up the resolver’s resources.

Botnet-based CPE attack: These attacks are carried out using CPE devices (Customer Premise Equipment, this is hardware given out by service providers for use by their customers, such as modems, routers, cable boxes, etc.) The attackers compromise the CPEs and the devices become part of a botnet, used to perform random subdomain attacks against one site or domain.

What’s the best way to protect against DNS-based attacks?

In addition to DNSSEC, an operator of a DNS zone can take further measures to secure their servers. Over-provisioning infrastructure is one simple strategy to overcome DDoS attacks. Simply put, if your nameserver can handle several multiples more traffic than you expect, it’s harder for a volume-based attack to overwhelm your server.

Anycast routing is another handy tool which can disrupt DDoS attacks; Anycast allows multiple servers to share a single IP address, so even if one DNS server gets shut down, there will still be others up and serving. Another popular strategy for securing DNS servers is a DNS firewall.

What is a DNS firewall?


DNS as a security tool
