DNS, DHCP & IP Address Management appliances
For Microsoft DNS & DHCP servers
For open source DNS & DHCP servers
Cloud-based visualization of analytics across DDI architecture
Manage multi-vendor cloud DNS servers centrally
RIR Declaration Management and Automation
Automated network device configuration and management
Centralized visibility over all your clouds
A single source of truth for your network automation
Why DDI is an Obvious Starting Point
DNS Threat Intelligence for proactive defense
Intelligence Insights for Threat Detection and Investigation
Adaptive DNS security for service continuity and data protection
Improve Application Access Control to prevent spread of attacks
Protect users and block DNS-based malware activity
Carrier-grade DNS DDoS attack protection
Optimize application delivery performance from the edge
for Proactive Network Security
Visibility, analytics and micro segmentation for effective Zero Trust strategy
Enable work from anywhere by controlling access, security and data privacy
Simplify management and control costs across AWS, Azure and GCP environments
Risk-free migration to reduce DDI complexity and cost
Move risk-free to improve performance, security and costs
Automate management, unify control and strengthen security of connected devices
Protect your network against all DNS attacks, data exfiltration and ransomware
Enable zero touch operations for network management and security
Improve resiliency, deployment velocity and user experience for SD-WAN projects
Integrated DNS, DHCP, IPAM services to simplify, automate and secure your network.
Simplify design, deployment and management of critical DDI services for telcos
Optimize administration and security of critical DDI services for healthcare
Simplify and automate management of critical DDI services for finance
Simplify and automate management of critical DDI services for higher education
Simplify and automate management of critical DDI services for retail
Simplify Management and Automation for Network Operations Teams
Elevate SecOps Efficiency by Simplifying Threat Response
Open architecture for DDI integration
Technology partnerships for network security & management ecosystems
Extend security perimeters and strengthen network defenses
Submit requests for temporary licenses
Submit access requests for EfficientIP knowledge platforms
Submit membership requests for EfficientIP Community
Strengthen Your Network Protection with Smart DNS Security
Customer-centric DDI project delivery and training
Acquire the skills needed to manage EfficientIP SOLIDserver™
Identify vulnerabilities with an assessment of your DNS traffic
Test your protection against data breaches via DNS
Dedicated representation for your organization inside EfficientIP
Explore content which helps manage and automate your network and cloud operations
Read content which strengthens protection of your network, apps, users and data
Learn how to enhance your app delivery performance to improve resilience and UX
Why Using DNS Allow Lists is a No-Brainer
This enterprise-grade cloud platform allows you to improve visibility, enhance operational efficiency, and optimize network performance effortlessly.
Who we are and what we do
Meet the team of leaders guiding our global growth
Technology partnerships for network security and management ecosystems
Discover the benefits of the SmartPartner global channel program
Become a part of the innovation
The latest updates, release information, and global events
What is a DNS Attack? Hackers have different possible objectives. They may aim to interrupt business, corrupt data, steal information, or all of these at the same time! To reach their goals, they continuously look for any vulnerability, and have developed a high variety of DNS attacks that fall into four main categories:
Attempt to overwhelm the DNS server by flooding it with a very high number of requests from one or multiple sources, leading to degradation or unavailability of the service.
Attacks exploiting bugs and/or flaws in DNS services, protocol or on operating systems running DNS services.
Low volume of specific DNS requests causing capacity exhaustion of outgoing query processing, leading to degradation or unavailability of the service.
Attacks using the DNS in a different manner than the original intention leading to data exfiltration and phishing.
As a fundamental service of the IP network and therefore the Internet, the DNS is mandatory in most of the exchanges. Any communication generally starts with a DNS resolution, from a FQDN easy to manipulate and remember to an IP address directly usable by the application. As soon as this resolution service becomes unavailable, most applications no longer function. It is therefore of real interest for attackers to try denying this service through bug exploit, flaws or by bypassing the protocol standard function. DNS is also a good vector to backdoor the systems in place since this protocol is accepted by all security solutions with limited verification on the protocol or the usage. This opens doors to data exfiltration, tunneling and all exploits using underground communications.
It is fundamental to understand that most often DNS threats are geared towards a specific DNS function (cache, recursive and authoritative), with precise damage objectives. This aspect must be integrated in the DNS security strategy to develop an in-depth defense solution, ensuring comprehensive attack protection. For more information on DNS security, take a look at the DNS security solution page.
The list below of the most common attacks emphasizes the diversity of the threats, and details the extent of the attack surfaces.
Flooding of DNS servers with direct requests causing saturation of cache, recursion or authoritative functions. This attack is usually sent from a spoofed IP address.
Use of publicly accessible open DNS servers for flooding a target system with DNS response traffic. The source address of a sent DNS name lookup request is spoofed to be the target’s address, which consequently receives the response. For maximizing amplification effect, a request for as much zone information as possible is sent.
Flooding authoritative servers or infrastructure components such as firewalls, with the objective often being to exhaust the bandwidth of the network targeted. The attack makes use of the numerous distributed open resolver servers on the Internet and is usually combined with amplification attacks.
Flooding of the DNS servers with non-existing domain requests implying recursive function saturation. This attack consumes resources on the DNS server for the recursion process and reduces its efficiency in answering legitimate queries. This attack is sometimes called a NXDOMAIN attack.
Zero-day attacks take advantage of DNS security holes in software for which no solution is currently available.
Attacks exploiting bugs and/ or flaws in DNS services, protocol or on operating system running DNS services.
DNS attacks based on malformed queries intending to crash the service.
Combination of javascript and IP subnet discovery in order to attack local network IP devices through the browser. This attack is mainly used for discovery of unsafe devices (targeting IoT) on the network, and for data exfiltration.
See how our DNS Guardian ensures DNS service continuity, detects data exfiltration via DNS tunneling and identifies unknown malicious domains.
Attacks using queries sent to hacker’s authoritative domain that very slowly answers requests, just before the time out, to cause capacity exhaustion on victim’s recursive server.
Attacks targeting DNS resolvers by sending them subdomains for which the domain server is unreachable, causing saturation of cache server capacity.
Attacks using random query name as a subdomain of the victim’s domain, causing saturation of its authoritative server capacity. This attack uses either open relay DNS or DNS recursive farm at ISP in order to also exhaust resources of servers waiting for answers from the authoritative server.
The DNS protocol is used to encapsulate other protocols or data in order to remotely control malware or/and the exfiltration of data.
Attacks introducing data into a DNS resolver’s cache, causing the name server to return an incorrect IP address for further requests, diverting traffic to the attacker’s computer.
Hosted on local computer, malware alters TCP/IP configurations to point to a malicious DNS server, causing traffic to be redirected to a phishing website.
DNS records are modified at the registrar level (after the compromission of administrator’s credentials) and users are redirected to malicious website since using valid domains.
Attack aiming to reuse an existing DNS entry (generally a CNAME) associated to a public cloud resource that has been suppressed.
Attack using registered domain names with a typo in order to get capture or redirect legitimate traffic to another web site.
Benefit from a swift security assessment of your existing DNS architecture and security systems in place to assess your current protection against data theft.
We use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
We use cookies to enhance your browsing experience, serve personalized content, and analyze our traffic. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site.
