Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

Is using a local DNS cache server imore secure than using a DNS server from a router?

share|improve this question
4  
Can you add a bit of context @Lance? A local cache server has more chance of being out of date if not updated regularly (so could be less secure in that respect) - so as you see, context around what threats you are facing and your specific needs and environment could be useful. – Rory Alsop♦ Jun 17 '11 at 8:52
Maybe I can help flush this one out. By security I assume you mean integrity of the mapping of domain name to IP address which is stored on a DNS server (local or remote). The answer to which machine will maintain better integrity is specific to the threat environment for each machine and its vulnerabilities and exposure. – this.josh Jun 17 '11 at 16:50

1 Answer

up vote 2 down vote accepted

Confidentiality standpoint: Not much really, it does combine your requests with others behind the device, and won't be making them as often as if you were doing it uncached.

Availability standpoint: if a site stops responding to DNS requests sometimes the DNS cache can maintain those requests for a long time (depending on the cache ttl.) Conversely, if a site is using DNS to perform load balancing or failover, you might be impacted if the site goes down and they switch to another IP for the host behind the name.

Integrity standpoint: Cache poisoning is a risk, you might be succeptable to it currently (or in the future.) It could also be used by an attacker, if the device was compromised, to redirect DNS requests to a hostile service.

None of these reasons are huge negatives, you can have all of these things applied at almost every layer of your network. Even Firefox has a DNS cache believe it or not. If you have the need, I'd use one. Just follow good security discipline while managing it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.