I know some antidotes for DNS cache poisoning attacks, both simple as port randomisation, and more complex as DNSSEC. But, which is the more effective? Which solutions are really deployed in the nameservers today?

Thanks for answers.


But, which is the more effective?

They address slightly different issues:

  • Port randomization makes DNS spoofing harder because there is an additional unknown secret for the attacker (the port) which must match for the spoofed answer.
  • With DNSSec one can reliably detect if the answer was spoofed.

Which solutions are really deployed in the nameservers today?

DNSSec everywhere could probably make port randomization obsolete, but currently we are far from a sufficient adoption. For the mean time we need port randomization. But this is not a server side solution, but instead must be done by the client (a DNS cache works as a client when asking another DNS server).


Cache poisoning occurs easiest when the entire infrastructure uses the same set of recursive resolvers. To mitigate this risk, I prefer to have different recursive resolvers for these roles:

  1. End user queries, Web surfing: For all workstations, or ideally WCCP, use a dedicated DNS infrastructure. For added security, use DNSSecurity like OpenDNS

  2. End user queries, all but Web surfing: The DNS host configured on the workstation should be isolated from the rest of the infrastructure that is described below

  3. Email processing and AntiSPAM - Emails that arrive query for SPF records, and other DNS checks that may result in a DNS query that posions the cache. For this reason I try to separate email processing from anything an end user tries to use on the general internet.

  4. DMZ, and header parsing utilities in the DMZ: If the DMZ acts on DNS data obtained from untrusted third parties, then it should be assumed that those DNS servers are possibly trying to poison your DNS.

  5. IDS, honey pots

Why is this important? Imagine that an attacker can coerce a DNS query that occurs on your core DNS server simply by sending an email, connecting to a given DNS server, or entering data into a HTML form. Since a recursive resolver will query all DNS servers as needed to satisfy the request, it's possible to pollute a cache entry for well behaved workstation users with that aforementioned infrastructure query.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.