DNS protection
Protecting DNS nowadays is very important, as attacks on DNS services are very high. Even the National Security Agency (NSA) has realized that a misconfigured DNS service is very dangerous and can leave a door open for attackers, causing a potential loss of confidential information. So, the following are some implementations that can protect a DNS server from attacks:
- Implement proper DNSSEC, which will help administrators to protect DNS servers against caching and poisoning attacks. For more information on the implementation, please follow this link: https://cloud.google.com/dns/docs/dnssec.
- Limit the DNS server’s interactions to avoid DNS tunneling from the victim’s machine to an external network.
- Log and monitor DNS’s malicious queries and responses, especially in the case of a newly built DNS end-to-end connection.
- Harden DNS recursive servers, especially in domain caching.