DNS attacks: types, examples and how to prevent them

Two kinds of DNS attack

The Domain Name System is the directory almost every connection depends on, so it is allowed through nearly every firewall and rarely watched closely. That makes it attractive to attackers in two quite different ways.

• DNS as a channel. The attacker uses ordinary-looking lookups to do something harmful: sending staff to a phishing site, delivering malware, letting an infected device receive commands, or carrying stolen data out of the network. The DNS system works exactly as designed; it is the destination or the content of the lookups that is malicious.
• DNS as a target. The attacker interferes with DNS itself: changing which resolver a device uses, forging answers, taking over the accounts that control your domain, or flooding DNS servers so nothing resolves.

Most organisations need controls for both. A protective DNS resolver deals with the first kind, because it decides which lookups are answered. The second kind needs good hygiene around resolvers, routers and the domains you own, which our DNS security best practices checklist covers. If you are new to the subject, start with what is DNS security?

DNS attack types at a glance

This table summarises the main DNS security threats, what each one does and the control that does most to stop it. Each linked attack has its own page with detection and prevention detail.

Amplification and reflection attacks

A DNS amplification attack is a type of distributed denial of service (DDoS). The attacker sends small DNS queries to many resolvers that answer anyone on the internet ("open resolvers"), but forges the source address so it looks like the queries came from the victim. Each resolver sends its answer, often much larger than the question, to the victim, whose connection or servers are overwhelmed.

You can be involved in two ways: as the victim, or as an unwitting amplifier if you run a DNS server that answers recursive queries from the whole internet. The controls are straightforward:

• Make sure your own resolvers only answer recursive queries from your own networks, and do not expose internal DNS to the internet.
• Use rate limiting on any authoritative DNS servers you run, or host public zones with a provider built for the load.
• Ask your internet provider what DDoS protection is available on your connectivity, as this attack is aimed at your bandwidth rather than at any one device.
• Networks that filter forged source addresses (source address validation, described in BCP 38) make the spoofing part of the attack much harder.

A related attack, the random subdomain or "water torture" flood, sends large numbers of made-up names under a real domain so every lookup misses the cache and lands on that domain's authoritative servers. The defence sits with whoever hosts the authoritative zone.

DNS rebinding

DNS rebinding turns a person's browser into a bridge to devices on the internal network. The attacker controls a domain and its DNS. A visitor loads a page from it; the page's script then makes further requests to the same name, but the attacker has changed the DNS answer to a private, internal address, such as a printer, camera, router admin page or development server. Because the browser thinks it is still talking to the same site, its same-origin protections can be sidestepped.

The defences are layered: protective resolvers that refuse to return private addresses for public domain names, authentication on every internal web interface (rebinding is most dangerous against devices that trust anything on the local network), and keeping management interfaces off user networks where you can.

DGA domains and command and control

Once malware is on a device, it needs to reach its controller for instructions. Hard-coding one domain is fragile, because that domain can be blocked or taken down. A domain generation algorithm (DGA) solves this for the attacker: the malware calculates a long list of random-looking domain names, often changing each day, and tries them in turn. The attacker only has to register one or two of them to regain control.

DGA traffic looks unusual from the DNS layer: bursts of lookups for long, meaningless names, most of which do not exist. That pattern is what DNS security services look for. The NCSC notes that some protective DNS providers attempt to block programmatically generated domain names, and Cisco says its Secure Access DNS Defense adds AI-based detection of DGA domains and DNS tunnelling; see Cisco DNS-layer security. Repeated blocks for command-and-control domains from one device are a strong sign that the device is already infected, so make sure those blocks raise an alert rather than sitting in a report.

Phishing on lookalike and newly registered domains

Phishing usually relies on a domain: a fake login page, a lookalike of a supplier's invoicing site, or a link in a text message. Attackers register names that differ from the real one by a character, swap letters for similar-looking ones, add words such as "secure" or "login", or use international characters that look identical on screen. Attackers often use these domains soon after registering them, before they build any reputation.

DNS security helps in three ways: phishing categories built from threat intelligence, optional categories for newly registered or newly seen domains, and logs that show who clicked. Our malicious domain checker guide explains how to judge a domain and whether to block brand-new ones. For the people side, pair it with phishing awareness training, and protect your own domain from being impersonated in email with DMARC.

How to prevent DNS attacks

No single product stops every DNS attack, but a short list of controls deals with most of them:

1. Use a protective DNS resolver that blocks phishing, malware and command-and-control domains, and ideally detects tunnelling and DGA patterns. Eligible public sector bodies should use the free NCSC PDNS service.
2. Force all DNS through it. Block outbound DNS on ports 53 and 853 that does not come from your own resolvers, and control browser DNS over HTTPS through device policy, as the NCSC advises.
3. Protect devices off site with a DNS roaming client, so laptops keep the same protection at home and on public Wi-Fi.
4. Log and alert. Send DNS logs to your SIEM or managed detection service and alert on repeated command-and-control blocks.
5. Secure what you own. Registrar lock, multi-factor authentication on registrar and DNS hosting accounts, and DNSSEC on your domains.
6. Harden resolvers and routers. Patch them, protect their management interfaces, and do not run open resolvers.
7. Test it. Use the checks in our DNS security test guide after every significant change.

How Forever Systems helps

We help organisations work out which of these attacks they are exposed to and which controls they already own. Some firewalls, endpoint products and SASE platforms you may already own include DNS protection that is not switched on or not fully configured. Where something new is needed, we can compare the options we supply, from Cisco DNS-layer security (Forever Systems is a Cisco Partner) to DNSFilter, Webroot, ThreatDown, Sophos and WatchGuard, on our DNS security solutions page.

Scope, pricing and any ongoing support are confirmed at quote. Contact us to talk it through.