DNS Security

Understanding how attackers target DNS helps you defend against these threats.

DNS Query Floods

What It Is: Overwhelming DNS servers with massive volumes of legitimate-looking queries.

How It Works:

• Attackers send millions of DNS queries per second
• Each query requires server processing
• Server resources exhausted
• Legitimate queries time out or fail

Attack Variations:

• Random subdomain attacks: Queries for non-existent subdomains (bypasses caching)
• Valid domain floods: Queries for real domains (harder to filter)
• Mixed query floods: Combination of record types (A, AAAA, MX, TXT)

Impact:

• DNS server CPU/memory exhaustion
• Query response delays or failures
• Cascading failures to dependent services

DNS Amplification Attacks

What It Is: Using DNS servers as amplifiers to flood a victim with traffic.

How It Works:

• Attacker sends small DNS query with spoofed source IP (victim's IP)
• DNS server responds with much larger answer to victim
• Amplification factor: 28x - 54x
• Victim receives overwhelming response traffic

Why It's Effective:

• Small botnet generates massive attack
• Responses come from legitimate DNS servers (hard to block)
• Open DNS resolvers worldwide available as amplifiers

Target Variations:

• Victim's DNS servers: Overwhelm DNS infrastructure
• Victim's network: Saturate bandwidth with amplified responses

Defense Challenge: Your DNS servers can be used as unwitting amplifiers against others—or targeted themselves.

NXDOMAIN Attacks

What It Is: Flooding DNS with queries for non-existent domains.

How It Works:

• Queries for random, non-existent subdomains
• Forces DNS server to process full resolution chain
• Cannot be cached (each query is unique)
• Consumes significantly more resources than cached responses

Example:

random1234.example.com
random5678.example.com
random9012.example.com
(millions of unique random subdomains)

Impact:

• Higher resource consumption per query
• Cache bypass (defeats caching protection)
• Slower response times for legitimate queries
• Server resource exhaustion

Phantom Domain Attacks

What It Is: Queries for domains hosted on non-responsive or slow-responding authoritative servers.

How It Works:

• Attacker controls domains with intentionally slow DNS servers
• Floods victim's DNS resolver with queries for these domains
• Resolver waits for responses that never come or come slowly
• Resolver's pending query queue fills up
• Legitimate queries blocked or delayed

Why It's Insidious:

• Doesn't require high query volume
• Exploits resolver's patience waiting for responses
• Difficult to distinguish from legitimate slow servers

DNS Cache Poisoning

What It Is: Injecting false DNS data into resolver caches.

How It Works:

• Attacker sends forged DNS responses
• If accepted, false data cached
• Users redirected to malicious servers

Impact:

• Users sent to phishing sites
• Man-in-the-middle attacks
• Data theft and credential harvesting

Defense:

• DNSSEC (cryptographically signed responses)
• Source port randomization
• Transaction ID randomization
• Secure resolver configuration

DNS Tunneling

What It Is: Encoding data in DNS queries/responses to bypass security controls.

How It Works:

• Malware encodes data in DNS query subdomain labels
• DNS responses carry command-and-control data
• Bypasses firewalls (DNS usually allowed outbound)

Use Cases:

• Data exfiltration
• Command-and-control communication
• Bypassing network restrictions

Detection:

• Unusually long subdomain queries
• High DNS query volume from single host
• Uncommon record types (TXT records with encoded data)

DNS Hijacking

What It Is: Unauthorized changes to DNS records redirecting traffic to attacker-controlled servers.

How It Works:

• Compromise DNS hosting account credentials
• Modify DNS records (A, MX, NS records)
• Redirect traffic to malicious infrastructure

Attack Methods:

• Phishing DNS hosting credentials
• Exploiting DNS provider vulnerabilities
• Registrar account compromise
• Man-in-the-middle during DNS updates

Impact:

• Email interception (MX record changes)
• Website traffic redirection (A record changes)
• Complete domain takeover (NS record changes)

Prevention:

• Strong authentication (MFA) on DNS management
• Registry lock on critical domains
• Regular DNS record audits
• Change notification alerts

Subdomain Takeover

What It Is: Claiming abandoned subdomains that point to external services.

How It Works:

• Subdomain points to external service (e.g., blog.example.com → hosting platform)
• Organization cancels external service but doesn't remove DNS record
• Attacker claims the same identifier on the external service
• Attacker now controls content at blog.example.com

Impact:

• Phishing under legitimate domain
• Malware distribution
• Brand damage
• SEO manipulation

Prevention:

• Audit DNS records regularly
• Remove records when decommissioning services
• Monitor for subdomain takeover attempts

Attack Trends

Multi-Vector DNS Attacks: Modern attacks combine multiple vectors:

• Query flood + amplification
• NXDOMAIN + phantom domain
• Volumetric + cache poisoning attempts

Sophisticated Targeting:

• Attacks during critical business periods
• Coordinated with other attack types
• Ransom demands specific to DNS

Key Takeaway: DNS faces diverse attack vectors—from brute-force floods to sophisticated poisoning and hijacking. Comprehensive protection requires defending against all vectors simultaneously.