Threat Analysis of the Domain Name System (DNS)

Abstract

Threat Analysis of the Domain Name System (DNS) Status of this Memo This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.

The Hitchhiker’s Guide to DNS Cache Poisoning

“…Many Internet security mechanisms, including host access control and defenses against spam and phishing, implicitly or explicitly depend on the integrity of the DNS infrastructure. Unfortunately, security was not one of the design considerations for DNS, and many attacks on DNS were reported over the years [3,12,15,19].…”

“…DNS cache poisoning results in a DNS resolver storing (i.e., caching) invalid or malicious mappings between symbolic names and IP addresses. Because the process of resolving a name depends on authoritative servers located elsewhere on the Internet (see Section 2.2), DNS protocol is intrinsically vulnerable to cache poisoning [3]. An attacker may poison the cache by compromising an authoritative DNS server or by forging a response to a recursive DNS query sent by a resolver to an authoritative server.…”

DNS Security Introduction and Requirements

“…These mechanisms are described below. These services protect against most of the threats to the Domain Name System described in [RFC3833]. Please see Section 12 for a discussion of the limitations of these extensions.…”

The E.164 to Uniform Resource Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Application (ENUM)

“…See Threat Analysis of the Domain Name System [RFC3833] for a review of the various threats to the DNS.…”