Learning DNS - DNS Security & Hardening

#Introduction

DNS is the most trusted infrastructure on the internet — and precisely for that reason it's a prime target. An unhardened DNS server can be used to poison answers, reflect DDoS attacks, or become a hidden data exfiltration channel.

Episode 16 dissects the main DNS threats, then installs layered defenses: from daemon behavior and dnsdist policies to Response Policy Zones. There's no single silver bullet — DNS security is the result of many layers working together.

#DNS Threats

#Cache Poisoning and Spoofing

Cache poisoning (popularized by the Kaminsky attack) injects fake answers into a recursor's cache. By flooding queries and guessing transaction IDs, an attacker can direct users to malicious servers. Spoofing works by forging answer packets before the real answer arrives.

#Amplification DDoS and Tunneling

• Amplification: an attacker sends small queries with the victim's address as the source (spoofed), and the server replies with a large answer — amplifying the DDoS attack many times over.
• DNS tunneling: data is encoded into queries and answers, turning DNS into a hidden communication channel for data exfiltration or remote control.

sudo tcpdump -i any port 53 -n -vv | grep -m 5 "53 >"

Notice the source ports on incoming answers: random, varying ports are one sign that 0x20 randomization is working.

#Hardening in the Recursor

#Random Source Ports and 0x20

The Recursor uses random source ports for every upstream query and 0x20 randomization — randomizing letter case in query names — so attackers find it far harder to guess the right combination:

min-pool-size: 20000
max-cache-entries: 2000000

With min-pool-size, the Recursor keeps its source port pool always large enough. The combination of random ports, random IDs, and 0x20 makes the chance of successfully guessing a fake answer extremely small.

#DNS Cookies (RFC 7873)

DNS Cookies are a lightweight mechanism: the client sends a cookie, the server validates and replies with its own. Servers that don't know the cookie get no response. Recursor 5.4 supports DNS cookies, including for outgoing connections:

use-dns-cookies: true

#Hardening in dnsdist

#Rate Limiting and Dynamic Rules

dnsdist limits per-client speed and dynamically blocks suspicious sources:

rateLimits:
  - qps: 50
    burst: 100
    ipv4mask: 24
    ipv6mask: 56

rateLimits caps queries at 50 per second per subnet. Attackers exceeding the limit are throttled without disturbing normal clients.

dynamicRules:
  - clientIP: 192.0.2.66/32
    action: Drop

With dynamicRules, clearly hostile addresses can be dropped outright. Together, both stop DNS DDoS at the front door.

#ACL and Source Validation

ACLs restrict who may query; on top of that, dnsdist uses ecs and source validation to prevent spoofed queries:

dnsdist -c
showACL()
addACL("10.0.0.0/8")
quit()

#Response Policy Zones (RPZ)

#Blocking Malicious Domains

RPZ (Response Policy Zones) rewrites answers for domains on a blocklist. It's like a firewall for DNS: queries to malware domains are redirected to NXDOMAIN or a sinkhole address.

rpz-file:
  - path: /etc/powerdns/rpz.block
    zone: rpz.internal
    maxTtl: 3600

With rpz-file, the Recursor loads the list of malicious domains. When a query arrives for a listed domain, the answer is rewritten per policy — users are prevented from reaching it without even realizing.

dig @127.0.0.1 malware.example.com A +short

If malware.example.com is on the RPZ list, its answer becomes NXDOMAIN or a sinkhole address, not the real IP.

#Defense in Depth

#Summary Checklist

One layer isn't enough. Combine them all:

ACL di recursor dan dnsdist
random source port + 0x20 randomization
DNS cookies aktif
rate limiting di dnsdist
dynamic block rules untuk sumber agresif
RPZ untuk domain berbahaya
DNSSEC validasi (episode 14)
encrypted DNS (episode 15)

This combination makes your DNS servers resilient against poisoning, spoofing, amplification, and tunneling.

#Conclusion

Episode 16 turns your DNS servers from easy targets into layered fortresses: understanding the poisoning, spoofing, amplification, and tunneling threats, then closing them off with random ports, 0x20, DNS cookies, rate limiting, dynamic rules, ACLs, and RPZ.

Key takeaways:

• Kaminsky-style cache poisoning and spoofing attack the trustworthiness of DNS answers.
• Random source ports, 0x20 randomization, and DNS cookies foil fake-answer guessing.
• dnsdist stops DDoS with rate limiting and dynamic block rules.
• ACLs restrict query sources; source validation prevents spoofing.
• RPZ rewrites answers for malicious domains to NXDOMAIN or a sinkhole.
• DNS security is many layers working together, not a single feature.

In episode 17, we'll cover dnsdist advanced: policy, cache, and Lua — load balancing policies and health checks with failover, packet cache and dynamic rules configuration, plus custom Lua scripting for server selection, per-client rate limiting, and query logging.