Why DNS is the Attacker's Favourite Channel
DNS — the Domain Name System — translates domain names to IP addresses. It is essential infrastructure, and as a result, it is almost never blocked at the perimeter. Attackers exploit this reality through DNS tunnelling: encoding command-and-control (C2) traffic or exfiltrated data inside DNS queries, which bypass firewalls that inspect only TCP/UDP traffic. A 2024 study by Infoblox found that 46% of organisations experienced a DNS-based attack in the previous 12 months. CERT-In has specifically flagged DNS as a critical infrastructure control requiring hardening and monitoring. ISO/IEC 27001:2022 A.8.20 network controls implicitly require DNS security as part of network management.
DNS Attack Taxonomy — What You Are Defending Against
| Attack Type | How It Works | Defence |
|---|---|---|
| DNS Tunnelling | Data exfiltration or C2 encoded in DNS queries | DNS traffic analysis, anomaly detection |
| Cache Poisoning | Injecting false DNS records to redirect traffic | DNSSEC, resolver hardening |
| DNS Hijacking | Modifying DNS records at registrar or resolver | Registrar MFA, DNS change alerts |
| DNS Amplification DDoS | Using open resolvers to amplify DDoS traffic | Disable open recursion on internal DNS |
| Malware C2 via DNS | Malware beaconing to C2 using DNS lookups | DNS RPZ (Response Policy Zones), threat feeds |
DNS Hardening — 7 Controls
- Disable open recursion: Internal DNS resolvers must only accept queries from internal IP ranges. Open resolvers on the internet are amplification attack participants.
- Implement DNSSEC: Deploy DNS Security Extensions on your authoritative DNS zones to cryptographically sign records and prevent cache poisoning. Indian enterprises hosting public-facing DNS should prioritise DNSSEC for their production domains.
- Enable DNS Response Policy Zones (RPZ): Block DNS resolution to known malicious domains using threat intelligence feeds. This silently blocks malware callbacks and phishing domains without blocking internet access.
- Log all DNS queries: Forward DNS query logs to your SIEM. Anomalous query patterns — high volumes to unusual domains, long subdomain strings (DNS tunnelling indicator), queries to recently-registered domains — should trigger alerts.
- Force all internal DNS traffic through controlled resolvers: Block direct external DNS (UDP/TCP 53) from user VLANs. All DNS must go through your hardened internal resolvers, not Google 8.8.8.8 or Cloudflare 1.1.1.1 directly.
- Secure DHCP with dynamic updates policy: Configure DHCP to only accept updates from authorised DNS servers (authenticated DDNS). Unauthorised DHCP servers on the network are a classic attack vector for ARP poisoning and MITM attacks.
- DHCP snooping on all switches: Enable DHCP snooping on all Layer 2 switches to detect and block rogue DHCP servers. This is a one-line configuration on most managed switches and should be a baseline standard.
DNS and DHCP Controls Assessed On-Site
InfraVeritas 360 includes DNS and DHCP security in every on-site foundation layer assessment — checking resolver hardening, logging configuration, DHCP snooping, and RPZ deployment.
Assess Your DNS Security →