8

Split DNS returns different results depending on the source IP.

It's commonly promoted as significant security measure for internal resources, for limiting enumeration and discovery.

I've had many issues with split DNS in the past, with programs that don't properly respect ttls. They cache resolution for a long time, and since DNS is inconsistent (i.e. it depends on my source IP), they break. Windows and Chrome, for example, have each been problematic for me.

I'm wondering about the security value of split DNS. DNS just maps text names to IP addresses. Is it somehow easier for an attacker to enumerate hostnames than IPs? Do internet addresses need to be secret? Is split DNS still valuable even with firewalls that block by source IP?

How much real security does split DNS offer?

  • 1
    Sometimes, there is a technical infrastructure need for this (AD), and the rationale, and extra complexity /hassle is a side effect. Sometimes the initiative for this design isn't security related. – goodguys_activate Aug 30 '15 at 5:31
  • @LamonteCristo, I would have though it would be just the opposite. It's easier for me to operate a DNS server that gives out consistent results to everyone rather than one that varies by source IP, or two different DNS servers. – Paul Draper Aug 30 '15 at 6:01
  • If you're using Windows DNS, it should be pretty easy to use Powershell to iterate through all the records and update them with the contents of the external DNS server (Get-DnsServerResourceRecord) – goodguys_activate Aug 30 '15 at 12:11
  • As a configuration note, don't configure the internal DNS server for recursion as it could receive a bad response from an external host. Instead have it forward unresolved requests to a recursive server in your DMZ or to a public DNS server. – user2320464 Aug 31 '15 at 17:39
  • @PaulDraper Split/horizon DNS is commonly a result of a Windows Active Directory domain not following the MS recommendations when naming their domain (or the domain creation predating those recommendations). If you name your Active Directory domain the same as your root external domain (Contoso naming their AD domain Contoso.com, for example), then you've stumbled into a split-horizon DNS configuration without even realizing it, and by the time you do realize it, or hire on someone who knows what he's doing, it can be prohibitively expensive to fix. – HopelessN00b Jul 1 '16 at 1:02
8

The first part of a targeted attack (i.e. to penetrate a network) is to find out as much as possible about the target. It is very common that a company uses the same domain name in the internal network as it does for public available sites. It is also very common that the name of host describes its purpose.

If you don't use Split DNS that would mean that you publish the information about all hosts inside a domain at a single public available place. These published information would reveal the names of the hosts and also the internally used IP addresses and could thus get an attacker lots of inside about the companies infrastructure.

DNS just maps text names to IP addresses.

Just a single example what an attacker could do when it knows these mappings for internal hosts:

  • Access the public available DNS information and find out that there is a host named wiki.example.com with the IP address 10.1.2.3. Given the name of the hosts this could be an internal wiki which probably provides interesting information about the company. Lets try to get exfiltrate the company-intern information published there.
  • To do this the attacker sets up its own website example.attacker. This server resolves initially to an external IP address controlled by the attacker. The DNS server for this domain is controlled by the attacker too. A link to this server will be included an interesting phishing mails or similar so that someone from inside the company will access the site.
  • Once the site got accessed and some scripts got downloaded the attacker will change the IP address for this site as visible from the company to the IP address of the site it likes to attack: i.e. example.attacker will now resolve to the same IP address 10.1.2.3 as wiki.example.com. This trick is called DNS Rebinding.
  • The script already downloaded from the attackers site then tries to access example.attacker. Since this site now resolves to 10.1.2.3 this request will access the internal server wiki.example.com, but with the name example.attacker. Servers used only for a single domain often ignore the Host header of the request so that the content of the site is accessible not only by using wiki.example.com but also example.attacker as long as both names resolve to the same IP address.
  • Because the Same Origin Policy only restricts access by DNS name and not by IP address the already loaded scripts from the original example.attacker host can now interact with the new example.attacker host site (which is wiki.example.com) and thus grab the information from this site and forward these information to the attacker.

In summary: the more you know about your target the better you can compromise it. Split DNS is not the ultimate solution to protect against all the data leaks but it helps to protect at least part of the data. Thus it is part of defense in depth.

I've had many issues with split DNS in the past, with programs that don't properly respect ttls. They cache resolution for a long time, and since DNS is inconsistent (i.e. it depends on my source IP), they break.

It looks like you use the same system (notebook or mobile?) both within the protected company network and in the unprotected internet. This is a very bad idea since this provides an easy vector for malware to get moved into the company network, bypassing all protections they might have. The secure way would be instead to have the company notebook never connect directly to the internet but only use a VPN when outside which tunnels everything through the company network, including DNS lookups. And private hardware should never connect to the protected company network, but should be instead contained inside a separate network when used inside the company. If used this way you should also not see problems with Split DNS, since you never switch between external and internal DNS setups on the same system.

| improve this answer | |
2

Split horizon DNS is a BAD idea. It basically makes DNSSEC impossible to implement reliably (there are workarounds but they are all unsatisfactory).

The main advantage of split horizon DNS is that it makes it possible to hide internal network, but the same can be achieved by creating a subdomain and making sure its SOA servers are not accessible from the public networks.

So with split horizon DNS you'd have payroll.bigcorp.com, with a secure subdomain you'd have payroll.i.bigcorp.com . But with a subdomain, you can actually use DNSSEC meaningfully.

| improve this answer | |
  • Did you know / try tools.ietf.org/html/… ? I'm asking because it seems to offer a solution for Split DNS + DNSSEC. – ieugen Dec 24 '19 at 10:01
  • Yes, I've been referring to this document ("there are workarounds"), they are all flawed in some way. – Cyberax Dec 25 '19 at 11:03
0

Another benefit to Split DNS that hasn't been discussed is recursion. It is best to disallow your internal DNS servers to perform recursive lookups. They could get a response that exploits a vulnerability leaving them compromised. Therefore offload this task to separate DNS servers or your public facing DNS servers. Its a great way to apply defense in depth and make your infrastructure more resilient.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.