0

Have have four name servers that control many other domains:

ns1.domain-name-our-brand-example.com
ns2.domain-name-our-brand-example.com
ns3.domain-name-our-brand-example.com
ns4.domain-name-our-brand-example.com

We want to improve the security and redundancy of this setup. We also want the ability to white label the name servers and remove our brand so that the name servers are more appealing to hosting resellers.

I believe the current setup is not fully redundant and in my security eye I see two probable "extreme" security situations:

Scenario 1, billing issue:

Account isn't paid and expires over a weekend. DNS goes offline. Mass disruption for all services.

Scenario 2, theft issue:

Account is stolen, and hi-jackers demand huge money in order to bring services back online.

From what I believe the industry standard way way to to avoid this would be to split the name servers across different TLDs and different accounts. For example:

ns1.domain-the-name-example.com
ns2.domain-name2-example.co.uk
ns3.domain-your-server-example.net
ns4.domain-get-online-now-example.org

I've seen this "best practice" at almost every single reputable host, but I'm struggling to find guidance or official documentation. The practice is almost as old as hosting so it's really hard to google.

Any tips? Advice?

1 Answer 1

1

Yes.

But not different TLDs, different registries (for example: if you use .com and .net in your nameservers, this does not bring any extra security because both TLDs are managed by a single registry).

You have here two almost opposite requirements:

We want to improve the security and redundancy of this setup. We also want the ability to white label the name servers and remove our brand so that the name servers are more appealing to hosting resellers.

First:

so that the name servers are more appealing to hosting resellers.

You don't need "white label" hosts for that. Just use a specific domain name for your nameservers that is "neutral" and does not contain your brand name or anything else. This solves this problem and makes things far simpler down the road.

Because if you let your customers use "any" domain name to name their nameservers it means your service is now depending on this domain name, under control of your customers and not you, and hence any problem there can affect your service.

Now for the core of the question: yes, any domain name "security" does depend also on the security of its nameservers (transitive dependency). For example if you provide DNSSEC services on the domain name you host, it makes sense if your nameservers are also themselves on names that are DNSSEC protected.

In the same way, they should be in different IP blocks and in different AS numbers, and of course in different datacenters (things are a little different if you employ anycast but I think this is outside of the question for now).

And now back to the name, using a single domain as suffix of all, or different names. It is rare that a whole TLD (specifically "big" ones) goes offline completely, yet it does happen. More than that if you use a single name, indeed you list possible scenarios, but even outside any attack, a name can be misconfigured involuntarily, it can be seized in case of disputes, etc.

As for:

Account isn't paid and expires over a weekend.

Any important name should be registered for the maximum amount of time allowed (10 years in gTLDs), and monitored, so that it is renewed upfront.

I don't think you will find any specific documentation on the above, even if you will see the case at many big providers. Another step towards better security, here regarding isolation, is to provide different sets of nameservers for the accounts you host, up to the extreme different sets per domain name, but at least per account or level of service (premium vs standard for example, especially if you bill DNS service separately and have conditions on it like number of queries per unit of time, etc.). It is easy to do by varying the ns label at extreme left, so it is orthogonal to the issue discussed above.

(and if you have enough IP addresses, like 4 /24 blocks for example, you can even make sure that each domain has almost a unique set of names and IP addresses for nameservers, if you attach multiple IP addresses to single nameserver names).

2
  • I disagree on your first point: different tld’s make a lot of sense even when registered at the same registry. Many tld’s have had issues with their root zone (for example problems with dnssec signing). Even if the domain is registered with the same registry, spreading name servers over different tld’s is good practice.
    – Teun Vink
    Dec 3, 2021 at 18:30
  • @TeunVink Yes but you gain little then, far less than just going the extra mile of picking different registries. Even if zonefiles are separate and all the backend (and often they aren't, how can you know how much of the DNSSEC signing infrastructure is shared between the two internally at the registry? You can't), you mitigate very little in fact. So just use the same TLD if you want, or go towards fully different registries. Middle state does not seem useful to me (especially as it gives a false sense of security), but YMMV. Dec 3, 2021 at 18:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .