DNS Security

Effective DNS security requires multiple protective layers.

DDoS Protection for DNS

Always-On Protection: DNS cannot afford activation delays—protection must be continuous.

Key Requirements:

• Massive Capacity: Handle Tbps-level attacks
• Global Distribution: Anycast network spreading load
• Intelligent Filtering: Distinguish legitimate from malicious queries
• Sub-Second Response: Maintain fast query resolution during attacks

Protection Mechanisms:

Query Rate Limiting:

• Limits queries per source IP
• Prevents single-source floods
• Adjustable thresholds per zone

Response Rate Limiting (RRL):

• Controls outbound response volume
• Prevents your DNS being used as amplifier
• Protects against amplification attacks

Traffic Scrubbing:

• Routes DNS traffic through scrubbing centers
• Filters malicious queries before reaching authoritative servers
• Returns only clean queries

Anycast Network Architecture

What is Anycast? Multiple servers share the same IP address in different geographic locations. Network routing automatically directs users to the nearest/best server.

Benefits for DNS:

Load Distribution:

• Attack traffic distributed across multiple locations
• No single point receives entire attack
• Localized attacks contained regionally

Automatic Failover:

• If one location overwhelmed, traffic routes to others
• No manual intervention required
• Built-in redundancy

Performance:

• Users query nearest DNS server
• Lower latency globally
• Better user experience

Attack Mitigation:

• 1 Tbps attack distributed across 20 locations = 50 Gbps per location (manageable)
• Geographic isolation contains regional attacks

DNSSEC (DNS Security Extensions)

What is DNSSEC? Cryptographic signatures verify DNS responses are authentic and unmodified.

How It Works:

• DNS zones are digitally signed
• Resolvers verify signatures using public keys
• Invalid or unsigned responses rejected

What DNSSEC Protects Against:

• Cache poisoning
• Man-in-the-middle attacks
• DNS response forgery

What DNSSEC Does NOT Protect Against:

• DDoS attacks
• DNS server compromise
• Hijacking via stolen credentials

Implementation Considerations:

• Requires key management
• Zone signing process
• Resolver must validate (not all do)
• Slight increase in response size

Best Practice: DNSSEC complements DDoS protection—use both together.

Multi-Layered Filtering

Layer 1: IP Reputation Filtering

• Block known malicious source IPs
• Threat intelligence feeds
• Real-time reputation scoring

Layer 2: Geographic Filtering

• Block or rate-limit queries from specific regions
• Useful when attacks originate from concentrated areas
• Caution: May impact legitimate international users

Layer 3: Query Pattern Analysis

• Detect NXDOMAIN attack patterns
• Identify random subdomain generation
• Flag phantom domain queries

Layer 4: Rate Limiting

• Per-source IP query limits
• Per-zone query limits
• Response rate limiting

Layer 5: Payload Inspection

• Validate query structure
• Block malformed queries
• Filter suspicious record type requests

DNS Redundancy Strategies

Multiple Authoritative Servers:

• Minimum 3-4 nameservers per zone
• Distributed across networks and geographies
• Different providers/infrastructure

Secondary DNS Providers:

• Use multiple DNS hosting providers
• Different infrastructure/networks
• Automatic failover between providers

Hidden Master Configuration:

• Public nameservers don't accept queries
• Queries answered by protected secondaries
• Master server hidden from attackers

Monitoring and Detection

What to Monitor:

Query Volume:

• Baseline normal query rates
• Alert on sudden spikes
• Track queries per zone

Query Types:

• Distribution of A, AAAA, MX, TXT queries
• Unusual record type requests
• ANY query volumes (often used in amplification)

NXDOMAIN Rate:

• Percentage of queries returning NXDOMAIN
• Sudden increases indicate NXDOMAIN attacks

Response Times:

• Average query resolution time
• Degradation indicates resource exhaustion

Source Distribution:

• Geographic query sources
• Per-IP query rates
• Botnet pattern detection

Alert Thresholds:

• 5x baseline query volume
• 10x normal NXDOMAIN rate
• Response time >100ms degradation
• Single IP >1000 queries/minute

Access Control

Zone Transfer Protection:

• Restrict AXFR/IXFR to authorized servers only
• Zone data shouldn't be publicly transferable
• Reduces reconnaissance opportunities

Query Restrictions:

• Disable recursion on authoritative servers
• Limit query sources if appropriate
• Block ANY queries (often used in amplification)

Management Access:

• Multi-factor authentication required
• IP whitelisting for DNS management
• Audit logging of all changes
• Regular access review

Incident Response

DNS Attack Playbook:

Detection:

• Automated monitoring alerts
• Query volume spike detected
• Response time degradation

Initial Response:

• Verify attack vs. legitimate traffic spike
• Identify attack type (query flood, NXDOMAIN, amplification)
• Activate additional scrubbing if needed

Mitigation:

• Apply appropriate filtering rules
• Increase rate limiting thresholds temporarily
• Failover to redundant providers if necessary

Communication:

• Update status page
• Notify stakeholders
• External communication if needed

Recovery:

• Verify attack subsided
• Restore normal filtering policies
• Monitor for recurrence

Post-Incident:

• Document attack characteristics
• Review mitigation effectiveness
• Update filtering rules
• Improve detection thresholds

Key Takeaway: DNS protection requires always-on DDoS mitigation, Anycast distribution, DNSSEC, multi-layered filtering, and comprehensive monitoring working together.

‍