DNS Monitor

This is the first part of a planned article series in three parts about how the DNS is instrumental in elevating the security for the email service. In this series we will cover how to counter spam with SPF, DKIM and DMARC records and continue with securing email transfer with certificate-signed TLS transfers using MTA-STS, TLSA and DANE.

This article describes why DNS monitoring requires a different approach than how IT systems normally are monitored. To be able to fully describe this we need to explain some fundamentals about how DNS infrastructures usually are implemented in most organisations.

Denial of Service attacks are also known as overload or blocking attacks and are as old as the Internet itself. These types of attacks have evolved over the years to resemble legitimate traffic in order to avoid detection of anti-DDoS countermeasures.

DNS tunnelling is a technique threat actors can use to establish a covert communication channel from inside a protected network.

The goal of a Hijacking attack is similar to the goal of cache poisoning attacks, but where the cache poisoning attack can only infect a small set of resolvers the Hijacking attacks targets and infects the source, the authoritative DNS servers. And by changing DNS records at the source, thousands of resolvers can spread the corrupt record, making successful DNS hijacking attacks substantially more dangerous.

The objective for a cache poisoning attack is to infect a DNS resolver cache with bogus data to redirect the victim to a host controlled by the attacker with the intention to extract information or plant malware.