1

In my organization (huge financial institute) there are 4 ns servers that are defined by NS DNS record to be the authoritative DNS servers of all of our public websites. However, I found that those DNS server send responses also if they are queried about any other domain.

I wonder whether there are security risks in this behaviour. References will be appreciated as well.

Improve this question
2
  • The are public dns servers? or private?
    – Sayan
    Jul 10, 2018 at 17:29
  • @Sayan public. They are authoritative for the organization's many public websites
    – Gari BN
    Jul 10, 2018 at 18:31

1 Answer 1

Reset to default
1

There is a small security risk associated with running a public recursive name server. Those risks include the possibility of increased load or being used as being part of a DNS amplification attack

You will have extra load on your servers if they are public recursive name servers as people will end up using them. A non-recursive name server will just reply with the DNS equivalent 0f "I don't have the answer" if people try to use it instead of say 8.8.8.8 as their defined name resolver.

Additionally attackers can fake a from/client address when performing a DNS lookup as part of an amplification attack, where that fake address then gets the response. Attacks fake a huge amount requests and DDoS the faked address. Read more about them here: https://www.us-cert.gov/ncas/alerts/TA13-088A

You public authoritative name servers should respond only to requests for you associated zones.

Hope that helps.

Improve this answer
2
  • Being abused for DNS amplification attack does not seem like a reason. In particular, it is possible to use the authoritative records for DNS amplification anyway.
    – Gari BN
    Jul 10, 2018 at 20:04
  • Good point Gari. It does complicate the attack as you'd have to craft each of your DDoS attacks to request from the DNS server something it will reply with. Where as a public recursive name server you could use the same attack request for all.
    – Joe M
    Jul 10, 2018 at 20:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .