0

I am a fairly security conscious web developer. One of my clients has their website hosted outside their corporate system, but all other services, including email and domain services go through their corporate IT Dept.

Their web host changed IP addresses, so I sent the new information to the corporate office for them to make changes to the A records. In response, they sent their local contact a text file that seems to be a dump of all the DNS information. That person didn't know what it was and forwarded it to me. The file includes:

  • SOA Record
  • A Records
  • CNAME Records
  • MX Records
  • TXT Records

The only information that is relevant to me, as an outside contractor are two A records. Am I correct in thinking that sending me that file through regular email channels is a security hole?

In the end, having the MX records helped me troubleshoot a separate web form problem, but that doesn't seem to be justification for me to have information about all the services they use.

Improve this question
2
  • 3
    Why is it a security hole? DNS is public ... Have you performed a DNS lookup on the domain? Aren't all those records present? This tool looks up all of those records: mxtoolbox.com/…
    – schroeder ♦
    Dec 27, 2021 at 17:18
  • This discussion and the tool link were precisely the type of information I was looking for. While we should all be security conscious, I do not specialize in that area. But, I do assume that it is not best practices to send server information that is not "need to know" to anyone.
    – Nora McDougall-Collins
    Dec 27, 2021 at 19:44

1 Answer 1

Reset to default
3

they sent their local contact a text file that seems to be a dump of all the DNS information.

This is typically called a zonefile, the whole content of the zone as used by nameservers (or exported from current nameservers if they use other things than text files for configuration).

Am I correct in thinking that sending me that file through regular email channels is a security hole?

It is bad practice but not a real security problem in itself.

First, there shouldn't be any sensitive information in the file itself, or almost. The names are public and often trivial like www, mail, etc. So they can be queried for. This is not true for all records too, like DKIM keys.

There could be "sensitive" data in the TXT records, depending on how they are used (ex: seeing for which other domains your zone is a DMARC receiver) however believing that noone will know/see them is a security benefit is mostly called "security through obscurity", and basically doesn't work.

DNS "enumeration" is one way to get intelligence on a target, but it is really a small part of it.

Improve this answer
7
  • Rereading your answer, I now see that you may be referring to items such as references to pphosted.com, domainkey, dkim.amazonses.com, dmarc_ruf@emaildefense.proofpoint.com, etc.
    – Nora McDougall-Collins
    Dec 27, 2021 at 19:50
  • 2
    Those are mostly public. Do a TXT query on zone apex and you will see the SPF records, do same of name _dmarc and you will see the DMARC stuff. It is only the DKIM stuff that noone can find out "immediately" because the names of the TXT records are not fixed in advance.
    – Patrick Mevzek
    Dec 27, 2021 at 20:09
  • Honestly, I'm not sure I'd consider it bad practice to send someone a zone file. It would be a bit weird (but not particularly dangerous) to post them publicly, but sending them to privately to a web developer on the off chance that they're useful seems fine. Even the DKIM keys are not particularly hidden (and the DKIM keys are public keys).
    – Brian
    Dec 31, 2021 at 15:01
  • @Brian "Even the DKIM keys are not particularly hidden" How do you find them since they can be on any record name? But yes the content is public.
    – Patrick Mevzek
    Dec 31, 2021 at 16:28
  • @Brian As for "I'm not sure I'd consider it bad practice to send someone a zone file." we can probably agree but for the sake of discussion note that multiple TLDs, especially ccTLDs, refuse AXFR and to give zonefiles as they consider the data not private but probably privacy protected because there could be personnally identifiable data in records names or data. On a security viewpoint, even if nothing is sensitive, you can work on the "least access privilege" posture, so giving to someone only the data it needs to its job, and it is rarely the full zonefile.
    – Patrick Mevzek
    Dec 31, 2021 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.