Comprehensive DNS Security and DNSSEC

Secure DNS management by using a generic admin contact, enforcing secure channels and MFA with the registrar, and avoiding open recursive servers.

Run BIND in a chroot jail, isolate the DNS service and restrict transfers with ACLs. Consider DNSSEC and split-horizon DNS with public acme.org and private acme.local, and disable local cache.

Follow RFC 1912 to avoid DNS configuration errors: keep billing and administrative contacts current, update NS IP only after registrar confirmation, validate changes with others, and use the BIND semicolon.

Track bad domains by monitoring typosquatting and using threat intel, WHOIS, and reverse WHOIS to identify registrants, then block suspicious domains including DGA patterns and apply RPZ policies.

Explore response policy zones (RPZs) as a DNS firewall on a recursive server. See how RPZs block bad domains and return NXDOMAIN, NO DATA, NO-OP, or Local Data.

Identify DNS server versions and technologies behind domains using dig and version.bind. Explore reverse DNS, PTR records, passive DNS history, and threat intelligence with tools like fpdns and Virustotal.

Expose common DNS attacks such as DNS-based DDoS, buffer overflow, DNS spoofing (cache poisoning), DNS amplification, domain hijacking, DNS tunneling, and the use of TXT records for covert channels.

Understand dns cache poisoning, where forged records in the additional section are cached by the recursive server to misdirect users, and how the bailiwick rule prevents this from outside authority.

Analyze how subdomain-based DNS cache poisoning works by flooding with imaginary subdomains, exploiting transaction IDs to corrupt recursion, and why closing open resolvers prevents this attack.

Explore DNS based denial of service, why UDP without handshakes enables DDoS, and how attackers impact providers; learn about three tools HPing3, LOIC, and netstress to test DNS resilience.

Analyze DNS amplification, a form of DDoS that uses small DNS queries to generate large responses from open resolvers, reflecting traffic to a target via spoofed addresses.

Configure Bind 9 recursive cache-only name server on Ubuntu, securing it with ACL and firewall, hiding its version, listening only on the internal 192.168.10.0/24 interface, and validate with dig.

Configure an authoritative dns server by defining the example.com master zone in named.conf.default-zones, creating db.example.com, and updating soa parameters; verify with named-checkconf and restart bind9.

Follow a practical BIND security checklist to harden DNS: disable recursion, run as an unprivileged user, enable rate limiting, apply ACLs, secure zone transfers, and enable logging.

Learn how dnssec authenticates dns responses by signing rrsets with a zone signing key, producing an rrsig, and verifying it with dnskey and trusted authorities using dig.

Verify the zone signing key with the key signing key, RRSet, and RRSIG. Update DS records via the registrar when KSK changes to maintain the root-level trust chain.

Explore TSIG, a secure, RFC 2845 protocol for authenticating dynamic DNS updates and zone transfers, using a shared secret, hash, and timestamp to protect updates, with clocks synchronized via NTP.

Thank you for attending the course; visit tznibae.com and LinkedIn for updates and feedback. Stay safe from physical diseases and virtual attacks.