Minimizing information leakage in the DNS

The Domain Name System (DNS) is the global lookup service for network resources. To protect DNS information, the DNS Security Extensions (DNSSEC) have been developed and deployed on branches of the DNS to provide authentication and integrity protection using digital signatures. However, signed DNS nodes have been found to have an unfortunate side effect: an attacker can query them as reconnaissance before attacking individual hosts on a particular network. There are different ways a zone administrator can minimize information unwanted leakage while still taking advantage of DNSSEC for integrity and source authentication. This paper describes the risk and examines the protocol and operational options and looks at their advantages and drawbacks.

• Type: Journal
• Year: 2008
• Where: NETWORK
• Authors: Scott Rose, Anastase Nakassis
• Keywords: DNS Security Extensions, Domain Name System, Global Lookup Service, NETWORK 2008