Secure Your Network with DNS: Episode 2 – Maximizing Application Availability & User Experience

This blog is the second of four episodes which help describe best practices for utilizing DNS to protect your overall network.

The internet would be nothing without the DNS and many recent events have highlighted this fact the hard way (Dyn attack, various ISP DNS outages, etc.). While routers are routing IP packets across the network, DNS is routing all the communications between the users and their applications, as well as the communications between the applications themselves. As a result, any failure or latency in the domain name resolution process results in significant impact on user experience. Maximizing DNS performance and availability is therefore essential for meeting the objectives of any connected business.

Meet the “A” from Availability

IT Security is commonly summarized by three main principles known as the AIC triad (Availability, Integrity and Confidentiality). Most of the time, securing a service is all about minimizing the risks related to these three principles. However, when it comes to the DNS, availability is fundamental. In fact, DNS is so critical that availability and performance were top considerations from the very beginning of the internet. Unfortunately, DNS security was a bit forgotten. Despite recent efforts to deploy DNSSEC and standardize confidentiality mechanisms, today it’s critical to, at minimum, adhere to the following deployment best practices in order to significantly strengthen any DNS service.

Use IP Anycast for redundancy

First, distribute your infrastructure as much as possible, if feasible leveraging several AS (Autonomous Systems) for public authoritative name servers while deploying resolvers as close as possible to the clients. Also, try to take advantage of IP Anycast for both redundancy and traffic optimization. This allows load to be spread across the DNS infrastructure, reducing the risk of complete failure caused by any external event, thus maximizing service availability. But why rely on a complex anycast implementation? DNS is a core network service, with DNS clients’ configuration staying pretty much static. Using IP redundancy therefore remains the most effective way to ensure DNS service availability for both authoritative and recursive DNS services. A simple NAT rule can do the trick, but it won’t support the load, so Anycast would seem to be the best choice.

Control Access

Second, implement basic security mechanisms such as RRL (Response Rate Limit) to prevent resource exhaustion, and implement proper access control to prevent unauthorized access and updates (using ACL, TSIG keys and GSS-TSIG when applicable). Remember that a recursive server will never be accessible from the internet (such servers are known as open resolvers) but only from the network to which it belongs. Even more important, implement proper firewalling policies to prevent DNS clients from a network reaching external resolvers. Only the ones within the network’s boundaries should be accessible, at least on an enterprise network. This prevents malwares and internal users from bypassing your DNS security mechanisms such as a DNS firewall or DNS Guardian, for instance.

And don’t forget to follow key deployment recommendations as well:

1. Avoid exposing critical resources to anyone, such as private domains or master DNS servers (refer to Stealth DNS architecture)
2. Do not mix different DNS functions within a single process (a recursive DNS should not be used to serve authoritative zones, in order to prevent DNS cache poisoning).

Regularly update DNS software

Finally, remember to upgrade your DNS software periodically, ideally combining technologies to mitigate zero-days attacks. This approach has the benefit of significantly reducing the risk of seeing your DNS servers fall over due to a simple DOS attack (such as a hacker sending just one single specially crafted DNS packet).

• Episode 1 – Best Practices Overview
• Episode 3 – Ensuring Security Through Integrity
• Episode 4 – How DNS Contributes to Global Network Security
• Blog post: Poor User Experience Across Your Network? DNS Can Help