Pros/cons of using a private DNS vs. a public DNS

Question

I was wondering why a company should use a private DNS.

In comparison with a public DNS, which advantages does a private one have, and which issues can a public DNS create for a company?

I'm new at these concepts of networks security, so maybe this is a very basic question.

Answer 1

DNS is a very broad topic, even when you narrow it to have a security focus, however I will attempt to address this in a way that will make most sense to you. If you are looking for a very high level introduction to DNS, I would suggest this. For a little bit more detail, check this out.

First of all, you may want to be aware that Private DNS vs. Public DNS can be construed to mean multiple things. The first thing that I thought of was split-horizon DNS, where you use the same DNS name for internal and external, but provide different information depending on the source of the DNS request. There are other options, however, such as choosing to use completely different names internally and externally (such as example.com publicly and example.local privately). I have seen both implemented in corporations, however having completely separate internal and external DNS servers and namespaces is preferred from a security point of view.

You would typically want to keep your RFC1918 addresses only in your private DNS, as well as your private addresses which are Internet-accessible. This is less important with IPv4, but with IPv6, having Internet-accessible IP addresses is much more widespread (although not necessary).

Essentially, it boils down to the fact that you would want a private DNS infrastructure in order to serve employees, so that they would not need to memorize the IPs (or VIPs) of every service. You would not want these DNS entries available to the Internet because it could be used for enumeration or discovery (see section 2.6), among many other reasons. The security of a system is said to boil down to some basic concepts, and you must keep in mind that, if you release certain information, if it allows anybody to compromise the CIA triad.

There is also the option of an extranet DNS infrastructure, which would be for partner companies, or companies that you do business with on a regular basis.

Finally, public DNS is provided as a service to your customers, again, so that they will be able to contact whatever it is you are providing. A couple of security concepts to keep in mind with DNS include:

• DNS Open Resolvers and Amplification attacks
• DNS Cache Poisoning Attacks
• Zone transfers from rogue DNS servers

There are many, many more types of attack when discussing DNS, but I feel like the previous few are a good starting point. If you are interested in DNS security, I would also point you to this write-up, and also DNSSEC.

Answer 2

Note that having a public DNS server does not mean that it knows all domain names in the network. DNS by design does not mean you have an authoritative copy of all zones, but uses s a hierarchical naming system.

Public and private DNS servers are split up for security and privacy reasons. If you advertise all of your internal domain names (used by your active directory domain for instance) you can inadvertently advertise the local IPs of these machines. While this does not mean that external hosts can access these machines, it leaks valuable information for an attacker.

Therefore you have the option to have a separate DNS server for your public domains, this DNS server knows nothing about the internal domain and thus cannot advertise domain names used internally. Everyone can query your public DNS server. Make sure that:

• Disable recursion on your public DNS so that it only answers to DNS requests for domain it is authoritative for. (prevents DNS cache poisoning if you configure your firewalls to not allow external IPs coming from the internet towards your internal network, which is used when spoofing)

You then also run a private DNS server (which should only be accessible from internal IPs and which should only respond to internal IPs). This DNS server contains information about your internal domains. This one can be configured recursive so that it also is able to resolve domains for which it is not authoritative. Make sure:

• I can't stress how important it is that it only answers to IPs on the internal domain.This will also largely mitigate the chance of a successful external DNS
• You also configure this DNS server to only use root hints and not forwarders (this can largely mitigate MITM attacks).
• Have a local caching nameserver (to prevent NXDOMAIN hijcacking)
• Recursion is allowed on a private DNS server as long as you make sure you have take the first point into account.

There is also the option of split-horizon DNS

In computer networking, split-horizon DNS, split-view DNS, or split DNS is the facility of a Domain Name System (DNS) implementation to provide different sets of DNS information, selected by, usually, the source address of the DNS request. This facility can provide a mechanism for security and privacy management by logical or physical separation of DNS information for network-internal access (within an administrative domain, e.g., company) and access from an unsecure, public network (e.g. the Internet). Implementation of split-horizon DNS can be accomplished with hardware-based separation or by software solutions. Hardware-based implementations run distinct DNS server devices for the desired access granularity within the networks involved. Software solutions use either multiple DNS server processes on the same hardware or special server software with the built-in capability of discriminating access to DNS zone records. The latter is a common feature of many server software implementations of the DNS protocol (cf. Comparison of DNS server software) and is sometimes the implied meaning of the term split-horizon DNS, since all other forms of implementation can be achieved with any DNS server software.

You should also have a look at DNSSEC

The Domain Name System Security Extensions (DNSSEC) is a suite of Internet Engineering Task Force (IETF) specifications for securing certain kinds of information provided by the Domain Name System (DNS) as used on Internet Protocol (IP) networks. It is a set of extensions to DNS which provide to DNS clients (resolvers) origin authentication of DNS data, authenticated denial of existence, and data integrity, but not availability or confidentiality.

I suggest you take your time to familiarize yourself with all these protocols.

Answer 3

Well, if you are registering your computers with your DNS server you probably don't want just anyone on the internet to be able to query what address your CEO's laptop is on. Likewise you don't want to make development servers, servers for unannounced services etc. to be made public.

As far as querying DNS servers for public addresses of other sites, maybe you want to re-direct some of those site requests through a proxy, or maybe you want to re-direct your users away from malicious sites. Maybe you just want to cut down on how much DNS traffic is going between your network and the internet, or ensure that all of your users are using known good DNS servers. Not letting DNS out to the internet except from designated DNS servers means your users' machines are not querying unknown and potentially hijacked DNS servers for every lookup.

Answer 4

A private DNS server has several advantages for a sysadmin:

• Because a private DNS is only available within a private network, that DNS server can resolve domains that are only valid within the network. You could, for instance, resolve "greatplains.accounting.int" to the company's main ERP server. Similarly, you could give everyone's machine a domain name, like brandon.smith.laptop, and have the DNS server sync with DHCP to keep IP addresses up to date (not a great idea if IP addresses change often, as local machines will cache DNS requests and responses that are no longer valid)
• Similarly, DNS can be used as a poor man's blacklist. Any domain you don't want people in your network browsing to (porn sites, known malware sites, other nonwork) can be listed in your private DNS, routing to an internal page telling them "stop screwing around and get back to work". There are better tools for this such as traffic analyzers, and there are always ways around it, but it works.
• A rough level of load-balancing can also be done by pointing different clients to different internal DNS servers that will route them to different service endpoint IPs. Again, better tools are available, but this works.
• A private DNS server allows you real-time control of your network's authoritative parent DNS server (the one who knows how to resolve any address that your own server can't). If your ISP calls and says "our DNS was hacked, use this alternate one instead until further notice", all you have to do is update your private DNS to refer to the new one as your authoritative parent, then instruct your users to open a command prompt and type ipconfig /flushdns, rather than changing the DNS settings in the network domain controller (DHCP, Group Policy), and requiring everyone to reboot their computers or otherwise reacquire their network address information.