Is using a local DNS cache server imore secure than using a DNS server from a router?

  • 4
    Can you add a bit of context @Lance? A local cache server has more chance of being out of date if not updated regularly (so could be less secure in that respect) - so as you see, context around what threats you are facing and your specific needs and environment could be useful. – Rory Alsop Jun 17 '11 at 8:52
  • Maybe I can help flush this one out. By security I assume you mean integrity of the mapping of domain name to IP address which is stored on a DNS server (local or remote). The answer to which machine will maintain better integrity is specific to the threat environment for each machine and its vulnerabilities and exposure. – this.josh Jun 17 '11 at 16:50

Confidentiality standpoint: Not much really, it does combine your requests with others behind the device, and won't be making them as often as if you were doing it uncached.

Availability standpoint: if a site stops responding to DNS requests sometimes the DNS cache can maintain those requests for a long time (depending on the cache ttl.) Conversely, if a site is using DNS to perform load balancing or failover, you might be impacted if the site goes down and they switch to another IP for the host behind the name.

Integrity standpoint: Cache poisoning is a risk, you might be succeptable to it currently (or in the future.) It could also be used by an attacker, if the device was compromised, to redirect DNS requests to a hostile service.

None of these reasons are huge negatives, you can have all of these things applied at almost every layer of your network. Even Firefox has a DNS cache believe it or not. If you have the need, I'd use one. Just follow good security discipline while managing it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.