DNS Security and Common Attack Vectors

DNS sits early in many connection flows, so manipulation can redirect users, disrupt services, or hide the infrastructure behind malicious activity.

Traditional DNS was not designed with cryptographic authentication for every response, which is why resolver hardening and DNSSEC validation are important defensive controls.

DNS spoofing attempts to provide a false answer for a query. Cache poisoning aims to make a recursive resolver retain an incorrect record so subsequent clients receive the malicious answer.

Modern mitigations include source-port and transaction randomization, hardened resolvers, DNSSEC validation, and careful delegation.

DNS amplification uses spoofed source addresses against exposed recursive resolvers to cause larger responses to be sent toward a victim. This converts relatively small attacker traffic into a larger reflected stream.

Resolver access controls, response-rate limiting, and closing unnecessary open-recursion paths reduce exposure.

DNS tunneling embeds data in DNS queries or responses to create a covert communication channel. Fast-flux techniques repeatedly change the IP addresses associated with a domain to make infrastructure harder to track.

Useful detection signals include unusual query entropy, high query frequency, rapidly changing answers, and unexpected resolver behavior.