Impact of configuration errors on DNS robustness

Abstract

During the past twenty years the Domain Name System (DNS) has sustained phenomenal growth while maintaining satisfactory performance. However, the original design focused mainly on system robustness against physical failures, and neglected the impact of operational errors such as misconfigurations. Our recent measurement effort revealed three specific types of misconfigurations in DNS today: lame delegation, diminished server redundancy, and cyclic zone dependency. Zones with configuration errors suffer from reduced availability and increased query delays up to an order of magnitude. Furthermore, while the original DNS design assumed that redundant DNS servers fail independently, our measurements show that operational choices made at individual zones can severely affect the availability of other zones. We found that, left unchecked, DNS configuration errors are widespread, with lame delegation affecting 15% of the DNS zones, diminished server redundancy being even more prevalent, and cyclic dependency appearing in 2% of the zones. We also noted that the degrees of misconfiguration vary from zone to zone, with most popular zones having the lowest percentage of errors. Our results indicate that DNS, as well as any other truly robust large-scale system, must include systematic checking mechanisms to cope with operational errors.

Enhancing DNS Resilience against Denial of Service Attacks

“…Following an opposite direction, Deegan et al [11] proposed to replace the DNS with a centralized system. While their objective was to improve many aspects of the system, such as its resilience to configuration errors [17], they argued that a centralized system could also sustain a DDoS attack. All these approaches of redesigning the DNS require a complete overhaul of the DNS structure.…”

Performance measurement and analysis of E-mail cluster systems by using three IP load-balancing technologies

“…Thus Domain Name System (DNS) [7] and Lightweight Directory Access Protocol (LDAP) [8] [9] are added on to the laboratory system. Several well-known network services, e.g., X.500 [10], LDAP [11] and Network Information Service (NIS), are suitable for managing user accounts.…”

Mass MailingWorm Detection by Means of Situation Aware DNS

“…DNS configuration errors have gradually become a major source of security problems. Studies indicate that even for a seemingly well functioning Internet system like DNS, human errors exist to a surprising extent [19]. This is because DNS management and configuration is considered as a complex, sophisticated and error-prone task among DNS operators.…”