DNS: the internet's phone book

Why DNS matters to defenders

Computers talk using IP addresses, but people remember names. DNS (Domain Name System) is the system that answers "what is the IP address of this name?". Because almost every connection starts with a DNS question, DNS logs are one of the best ways to see which websites and servers a device is reaching, including malware calling its control server.

How a lookup works

1. Your laptop asks its resolver (usually your router, your ISP or a public resolver) "what is the address of shop.example?"
2. If the resolver does not already have the answer cached (saved), it asks a root server, which points to the server for .example.
3. That server points to the authoritative name server for shop.example, which knows the real answer.
4. The resolver returns the answer to you and caches it for the time set by the TTL (time to live).

Record types

$ dig shop.example A +short
203.0.113.10
$ dig shop.example MX +short
10 mail.shop.example.
$ dig _dmarc.shop.example TXT +short
"v=DMARC1; p=reject; rua=mailto:dmarc@shop.example"

PS> Resolve-DnsName shop.example -Type A

Name           Type   TTL   Section    IPAddress
----           ----   ---   -------    ---------
shop.example   A      300   Answer     203.0.113.10

DNS normally uses UDP port 53, and TCP port 53 for large answers and zone transfers. Newer encrypted forms are DNS over HTTPS (DoH, port 443) and DNS over TLS (DoT, port 853).

Email security records

• SPF (Sender Policy Framework): a TXT record listing which servers may send mail for the domain.
• DKIM (DomainKeys Identified Mail): the sending server signs each email; the public key to check the signature is published in DNS.
• DMARC: a TXT record at _dmarc.domain that tells receivers what to do when SPF and DKIM checks fail: p=none (only report), p=quarantine (send to spam) or p=reject (refuse).

A domain with p=reject is much harder to spoof in phishing emails. Many banks and government domains now publish strict DMARC policies.

How attackers abuse DNS (and how it is detected)

• Look-alike domains (typosquatting), such as a letter swapped or added. Detect: watch new domain registrations similar to your brand, and block newly registered domains.
• DNS hijacking: changing a domain's records at the registrar after stealing the account login. Prevent: MFA and registrar lock on domain accounts.
• Cache poisoning: feeding a resolver a fake answer. Prevent: DNSSEC (signed DNS answers) and up-to-date resolvers.
• DNS tunnelling: hiding data inside many long, random-looking sub-domain queries. Detect: very long names, many unique sub-domains for one domain, and unusual volumes of TXT queries.

Common mistakes

• Leaving DMARC at p=none forever. It only reports; it does not stop spoofing.
• Forgetting that DNS is often not logged. Turn on resolver logging so investigations can see lookups.
• Thinking a domain is safe because it resolves. Every phishing site resolves too.