A couple of questions regarding DNS traffic between TRUST and DMZ and best practices.

Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS protocol ever be used to exploit/compromised a Windows Domain Controller (the DNS Server)?

Can a NGFW traffic inspection/filtering reduce this risk to make it acceptable ?

1 Answer 1


Knowing that is a Domain Controller, it would then be only used by people within the internal network right? Might wanna double check with this related question.

Whether or not your host it in the DMZ, I highly recommend aiming for a setup where only traffic involving UDP port 53 is allowed and that's both inbound and outbound.

You could achieve that through configuring NGFW, some device that has a stateful firewall, or a host-based firewall within the DNS server. If you could have like 2-3 of these done then that's good since defense in-depth is very good practice. Test that it's working properly for each defense configured to ensure availability of your device.

If you're placing it in the DMZ however, it is of absolutely importance to have a firewall device between your DNS Server and the router to ensure it is segmented and kept away from your internal network should it get compromised by hacker/s.

Always remember that no defense is absolute so prepare plans/protocols to follow should a hacking attack succeeds and escalates to prevent/re-mediate the emergency.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .