I have recently started working for a company which disables external DNS resolution from the machines inside the network by not adding external forwarders to the internal DNS servers - the reasoning behind this is for security.

It seems a bit heavy-handed to me and it's causing me issues as the company moves towards more cloud services.

Can anyone suggest a way that I could reach a compromise to provide security? I was thinking we should use external forwarders but apply filtering e.g https://docs.microsoft.com/en-us/windows-server/networking/dns/deploy/apply-filters-on-dns-queries

  • 2
    It is not really clear for me what the setup exactly is and what kind of problem you have with it. Do they have a central internal NS which does all lookups itself (i.e. recursive resolver for the whole network). Do they have such an NS on each maschine or VM image? And how exactly is this a problem when using cloud services? Commented Mar 23, 2018 at 10:17
  • 1
    It's an active directory environment so all the DNS servers replicate the internal DNS zones (e.g. servername.company.local) between each other so lookups for internal resources are fine and unrestricted - but if I need to look up a DNS address for a cloud provider this is currently blocked e.g an external lookup for office365.com won't resolve. My idea is to use DNS filtering or a conditonal forwarder for the DNS lookups combined with firewall rules allowing access to the appropriate IP ranges to allow the client machines to go directly to the internet for these services
    – BenSBB
    Commented Mar 23, 2018 at 10:37
  • 1
    First, please provide such essential information in the question and not only in a comment. But to your question: limiting the attack surface is always beneficial and limiting access to the outside helps to limit attack surface. But in your specific case it looks like that the current policy also infers with the work you have to do. In this case you need to discuss the issue with your local system administrators. If your proposed solution is possible and the best way in your specific case is unknown. Commented Mar 23, 2018 at 10:56

2 Answers 2


When firewalls are correctly configured, DNS is our way into and out of the network. Depending on your security level, blocking DNS where it is not needed can be useful hardening.

As a security consultant, it is not that uncommon to find yourself in a system with a limited server-side request forgery or some other server-side vulnerability. Some customers have very well-configured firewalls which prevent us from using it to get much further, but through DNS we can typically still learn more about the network and sometimes setup useful data tunnels. In such a case, disabling DNS would be the final nail in the coffin.

it's causing me issues

That is the risk: if you disable DNS and someone does need it (for example for apt update), you risk that sysadmins use ugly workarounds, making the network less secure instead of more secure. If you can't do your work properly, then disabling DNS altogether is not the right choice.

Might a limited resolver be a solution? It could run on localhost or perhaps on a dedicated system, and it could be configured to only resolve a whitelist of domains. Since you mention you're moving your data and applications to other people's computers ("the cloud"), it sounds like you might only need to resolve the domains belonging to whatever SaaS/*aaS service your company uses.

The pitfall there is that whitelisting something like *.cloudCorp.example.com probably allows an attacker to buy a VPS at cloudCorp and get a matching domain name. That would be something to watch out for. But even if this is unavoidable (and that's not a given), it's better than allowing all DNS queries.


DNS is critical for security teams as it is a primary avenue for visibility into what systems are talking to who on the outside world. So your security team will want to centralize all lookups and log the requests & responses.

There are lots of attack avenues such as DNS data exfiltration , DNS tunneling , DNS poisoning , and DNS as command and control so controlling DNS is critical for a security team.

As to what is blocked or not blocked that is more of a detail you would need to work out with your specific team/administrators, but yes DNS security and logging is critical to every company.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .