1

In my organization (huge financial institute) there are 4 ns servers that are defined by NS DNS record to be the authoritative DNS servers of all of our public websites. However, I found that those DNS server send responses also if they are queried about any other domain.

I wonder whether there are security risks in this behaviour. References will be appreciated as well.

  • The are public dns servers? or private? – Sayan Jul 10 '18 at 17:29
  • @Sayan public. They are authoritative for the organization's many public websites – Gari BN Jul 10 '18 at 18:31
1

There is a small security risk associated with running a public recursive name server. Those risks include the possibility of increased load or being used as being part of a DNS amplification attack

You will have extra load on your servers if they are public recursive name servers as people will end up using them. A non-recursive name server will just reply with the DNS equivalent 0f "I don't have the answer" if people try to use it instead of say 8.8.8.8 as their defined name resolver.

Additionally attackers can fake a from/client address when performing a DNS lookup as part of an amplification attack, where that fake address then gets the response. Attacks fake a huge amount requests and DDoS the faked address. Read more about them here: https://www.us-cert.gov/ncas/alerts/TA13-088A

You public authoritative name servers should respond only to requests for you associated zones.

Hope that helps.

| improve this answer | |
  • Being abused for DNS amplification attack does not seem like a reason. In particular, it is possible to use the authoritative records for DNS amplification anyway. – Gari BN Jul 10 '18 at 20:04
  • Good point Gari. It does complicate the attack as you'd have to craft each of your DDoS attacks to request from the DNS server something it will reply with. Where as a public recursive name server you could use the same attack request for all. – Joe M Jul 10 '18 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.