I have recently started working for a company which disables external DNS resolution from the machines inside the network by not adding external forwarders to the internal DNS servers - the reasoning behind this is for security.

It seems a bit heavy-handed to me and it's causing me issues as the company moves towards more cloud services.

Can anyone suggest a way that I could reach a compromise to provide security? I was thinking we should use external forwarders but apply filtering e.g https://docs.microsoft.com/en-us/windows-server/networking/dns/deploy/apply-filters-on-dns-queries

  • 2
    It is not really clear for me what the setup exactly is and what kind of problem you have with it. Do they have a central internal NS which does all lookups itself (i.e. recursive resolver for the whole network). Do they have such an NS on each maschine or VM image? And how exactly is this a problem when using cloud services? – Steffen Ullrich Mar 23 '18 at 10:17
  • 1
    It's an active directory environment so all the DNS servers replicate the internal DNS zones (e.g. servername.company.local) between each other so lookups for internal resources are fine and unrestricted - but if I need to look up a DNS address for a cloud provider this is currently blocked e.g an external lookup for office365.com won't resolve. My idea is to use DNS filtering or a conditonal forwarder for the DNS lookups combined with firewall rules allowing access to the appropriate IP ranges to allow the client machines to go directly to the internet for these services – BenSBB Mar 23 '18 at 10:37
  • 1
    First, please provide such essential information in the question and not only in a comment. But to your question: limiting the attack surface is always beneficial and limiting access to the outside helps to limit attack surface. But in your specific case it looks like that the current policy also infers with the work you have to do. In this case you need to discuss the issue with your local system administrators. If your proposed solution is possible and the best way in your specific case is unknown. – Steffen Ullrich Mar 23 '18 at 10:56

DNS is critical for security teams as it is a primary avenue for visibility into what systems are talking to who on the outside world. So your security team will want to centralize all lookups and log the requests & responses.

There are lots of attack avenues such as DNS data exfiltration , DNS tunneling , DNS poisoning , and DNS as command and control so controlling DNS is critical for a security team.

As to what is blocked or not blocked that is more of a detail you would need to work out with your specific team/administrators, but yes DNS security and logging is critical to every company.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.