Are authoritative nameservers vulnerable to DNS amplification/reflection or other kinds of attacks?

Question

I have been learning about DNS over the last few days.

For fun and learning, I wanted to try to set up an authoritative nameserver for my own domains. I also considered building a small tool for people to check which DNS resolver they are using (by logging the IPs that query the nameserver and showing them to the user).

I am aware that creating open resolvers is generally advised against.

I was wondering if it was equally discouraged to have an open non-recursive, authoritative nameserver for whatever reason. I notice that most registrars seem to have their own, but wanted to check if there were any caveats.

So, my questions:

• Would an open non-recursive, authoritative nameserver be vulnerable to DNS amplification/reflection/other attacks in the same way that recursive resolvers are?
• If not, why not?
• Are there any attacks specific to non-recursive authoritative nameservers that I should be mindful of?
• If so, to what extent can these attacks be mitigated?

Answer 1

The big difference is that an authoritative nameserver, by definition, controls the content of the data (zone) it serves. When a recursive resolver is just an intermediate and does not control anything. The other big difference is that clients of authoritative nameservers are not (under normal resolution behavior) final end clients but just other recursive nameservers (which makes mitigation based solely on source IP be complicated, in a world where some public recursive nameservers do handle quite a fair chunk of all requests), while recursive nameservers may see the final end client (not always true, as they can be chained for cache reasons, and there is also VPNs and NATs).

For the authoritative nameservers it consults, a recursive nameserver is the client and hence "responsible" for what it sends to it. If anyone creates a 60k long TXT records in its zone, any recursive resolver having to resolve that specific record is immediately prone to an amplification attack, if it gets queried by someone spoofing clients source address.

What happened in the past (and still now but less) is that a lot of people misconfigured their recursive nameservers and let them open not just on their network but publicly. They were easy to abuse because very often there was really nothing in place to monitor or protect them. Today's picture is a little different with multiple big open resolvers... run by dedicated team that are well aware of the perils of that hence having dedicated resources to it.

There are specific solutions for authoritative nameservers, like ratelimit. See "4.2.16.19. Response Rate Limiting" in Bind documentation at https://ftp.isc.org/isc/bind9/cur/9.17/doc/arm/html/reference.html :

Excessive, almost-identical UDP responses can be controlled by configuring a rate-limit clause in an options or view statement. This mechanism keeps authoritative BIND 9 from being used to amplify reflection denial-of-service (DoS) attacks. Short BADCOOKIE errors or truncated (TC=1) responses can be sent to provide rate-limited responses to legitimate clients within a range of forged, attacked IP addresses. Legitimate clients react to dropped responses by retrying, to BADCOOKIE errors by including a server cookie when retrying, and to truncated responses by switching to TCP.

Because attacks on authoritative nameservers exist. See for example (not exhaustive, of course):

• description of a "random" qname attack on fr. authoritative nameservers: https://labs.ripe.net/author/santiago_r_r_/a-software-based-approach-to-identify-heavy-hitters-in-dns-traffic/
• a big attack on DynDNS infrastructure: https://www.thousandeyes.com/blog/dyn-dns-ddos-attack
• a more recent case called "NXNSAttack": https://en.blog.nic.cz/2020/05/19/nxnsattack-upgrade-resolvers-to-stop-new-kind-of-random-subdomain-attack/

I notice that most web hosts seem to have their own

Be aware here of the sloppy naming. A domain name registrar, a DNS provider, an email hoster and a web hoster, are 4 completely different jobs. They can be done by the same company, but technically, while related, they are separate. A web hoster can decide to provide also DNS services just to simplify (and to control more) its users experience, but this is not required in any way, and can even sometimes be seen as a drawback.