DNS is a
hierarchical database
mapping domain names to IP addresses. Domain name =
name in DNS format (e.g. www.cc.gatech.edu).
Zone = set of names under same authority (e.g.
.com). Delegation = transfer of
authority for a subdomain.
root → org/net/edu/com → wisc/ucb/gatech/mit → cs/ee → www. There are 13 DNS root name servers.
| Type | Purpose |
|---|---|
| A | Address record (IP address) |
| NS | Name server (points to other server) |
| MX | Mail exchanger (handles email) |
| TXT | Generic text (e.g. DKIM public keys) |
Lookup is iterative or recursive. Client asks local resolver; resolver queries root → TLD → authoritative server. Each step returns delegation (NS + glue records) until the final authoritative answer.
DNS uses UDP (port 53). Packets include IP header, UDP header, and DNS data. Query ID (16-bit, sometimes called transaction ID) links response to query.
Response is cached only if within same domain as query.
a.com cannot set NS for b.com.
Users and hosts trust the host–address mapping from DNS. It underpins same-origin policy, URLs, and many security decisions. Interception or compromise of DNS servers yields incorrect or malicious responses.
DNSSEC provides authenticated requests/responses - but few use it yet.
Goal: give DNS servers false records and get them cached. Cache may be poisoned when the resolver: (1) has predictable Query IDs, (2) accepts unsolicited DNS records, (3) disregards identifiers.
Attacker guesses Query ID and sends forged response before legitimate one. If wrong, attacker must wait for TTL to expire before retrying - limits attack rate.
Ask for random non-existent subdomain:
$RAND.www.google.com. Each query is unique →
no TTL wait. Attacker floods with forged responses
(e.g. "Ask www.google.com = 6.6.6.6") until Query ID is
guessed. Can succeed in ~10 seconds.
Attacker floods resolver with forged responses; no wait between attempts.
Add ~11 bits; attack takes hours instead of seconds. DNS system load can be a concern.
Larger ID space makes guessing harder.
Attacker must guess Query ID correctly twice (32 bits combined).
Cryptographic signing of responses - fundamental fix. Deployment still limited.
DNSSEC provides: authenticity of answer origin, integrity of reply, and authenticity of denial of existence. Accomplished by signing DNS replies at each step using public-key cryptography. Trust anchors in the OS bootstrap the process.
Each step is signed; chain of trust from root to leaf.
DNSSEC cannot stop the DNS Rebinding attack - the response is authentic; the attack abuses same-origin policy.
Attacker registers a domain (e.g. evil.com) and delegates
to a server under control. Page loads with attacker's external IP;
short TTL ensures record expires quickly. On next request, attacker
rebinds the hostname to an
internal IP (e.g. 192.168.0.100). Browser treats it
as same origin; malicious script reads internal content.
www.evil.com (iframe/ad). DNS returns
171.64.7.115 (attacker), TTL=0
Short TTL means the record expires quickly - not that it is "quickly cached." Attacker needs the first response cached briefly, then rebinds before next lookup.
Refuse to switch to a new IP for a domain. Interacts poorly with proxies, VPNs, dynamic DNS. Not consistently implemented in browsers.
Check Host header for unrecognized domains.
Authenticate users with something other than IP.
External domain names cannot resolve to internal addresses. Protects browsers inside the organization.
Step-by-step explanation of traditional vs. Kaminsky poisoning; DNS packet structure; mitigation techniques.