L4. Compare recursive and iterative DNS resolvers. What are security challenges in DNS?

Question 1

What is a DNS resolver?

Answer 1

A specific type of DNS server responsible for translating domain names into IP addresses

Question 2

What is a recursive DNS resolver?

Answer 2

A DNS resolver that handles the whole DNS resolution process for the client. The resolver collects all the necessary information and sends back a complete response.

Question 3

What is an iterative DNS resolver?

Answer 3

A DNS resolver that handles only the initial DNS query. It provides the next step rather than the complete answer, requiring the client to follow a chain of referrals to DNS servers to get the final answer.

Question 4

What is the recursive DNS resolution process?

Answer 4

1. Client (e.g., a web browser) queries a recursive resolver
2. The recursive resolver queries multiple DNS servers on behalf of the client, starting with the root DNS servers, then proceeds to TLD (Top-Level Domain) servers, and finally to the authoritative servers for the domain in question.
3. The resolver collects all the necessary information and sends a complete response back to the client.

Question 5

What is the iterative DNS resolution process?

Answer 5

1. The client queries an iterative resolver
2. The resolver provides partial information, directing the client to other DNS servers.
3. The client queries each DNS server sequentially. For instance, it starts with the root server, which points to a TLD server, and then queries the TLD server, which points to an authoritative server.

Question 6

What are advantages and disadvantages of recursive DNS resolvers?

Answer 6

Advantages: simplicity and caching.

Clients do not need to handle the complexity of querying multiple servers. Recursive resolvers often cache responses, reducing latency for repeated queries and decreasing the load on DNS infrastructure.

Disadvantages: overhead and bottlenecks.

The resolver handles the entire query process, which can be resource-intensive. A high load on recursive resolvers can become a bottleneck, impacting response times.

Question 7

What are advantages and disadvantages of iterative DNS resolvers?

Answer 7

Advantages: reduced load on resolvers and client control.

Each server only needs to provide partial information, distributing the load. Clients have more control over the query process, which can be advantageous in certain scenarios.

Disadvantages: complexity and increased latency.

Clients must handle multiple queries and manage the state of the ongoing resolution process. The overall resolution process may take longer due to multiple round trips between the client and various DNS servers.

Question 8

What are security challenges in DNS?

Answer 8

Spoofing, tunneling, DDoS attacks, MitM attacks, amplification attacks, registrar hijacking, typosquatting and homograph attacks

Question 9

What is DNS spoofing?

Answer 9

When attackers insert false information into the cache of a recursive resolver, redirecting users to malicious sites.

Question 10

How can spoofing be mitigated?

Answer 10

DNSSEC (Domain Name System Security Extensions) provides data origin authentication and data integrity to protect against spoofing attacks.

Question 11

What is DNS tunneling?

Answer 11

When attackers encapsulate other protocols within DNS queries and responses to bypass security measures and exfiltrate data.

Question 12

What are DDoS attacks?

Answer 12

Distributed Denial of Service Attacks: Attackers overwhelm DNS servers with a high volume of queries, causing service disruption.

Question 13

How can DNS tunneling be mitigated?

Answer 13

Monitoring and filtering DNS traffic, using DNS firewalls, and anomaly detection systems can help detect and block tunneling activities.

Question 14

How can DDoS attacks be mitigated?

Answer 14

Using redundant DNS infrastructure, anycast routing, and DDoS mitigation services can help absorb and deflect attack traffic.

Question 15

What are MitM attacks?

Answer 15

Man-in-the-Middle Attacks: Attackers intercept and potentially alter DNS queries and responses between clients and DNS servers.

Question 16

How can MitM attacks be mitigated?

Answer 16

Using DNS over HTTPS (DoH) or DNS over TLS (DoT) encrypts DNS queries and responses, protecting them from interception and tampering.

Question 17

What are DNS amplification attacks?

Answer 17

When attackers exploit the amplification effect of DNS queries to generate large volumes of traffic, overwhelming the target network.

Question 18

How can DNS amplification attacks be mitigated?

Answer 18

Implementing response rate limiting (RRL) on DNS servers can help reduce the impact of amplification attacks.

Question 19

What is registrar hijacking?

Answer 19

When attackers gain unauthorized access to domain registration accounts to modify DNS settings, redirecting traffic or taking domains offline.

Question 20

How can registrar hijacking be mitigated?

Answer 20

Using strong authentication mechanisms, such as multi-factor authentication (MFA), and monitoring account activity can help protect against hijacking.

Question 21

What is typosquatting and homograph attacks?

Answer 21

When attackers register domain names that are similar to legitimate ones (e.g., using visually similar characters) to deceive users.

Question 22

How can typosquatting and homograph attacks be mitigated?

Answer 22

User education, browser defenses, and domain registration policies can help reduce the effectiveness of these attacks.