DNS Server¶
A DNS server answers name lookups. Misconfigured, it hands an attacker a map of every host on the network, lets anyone register fake records, or gets used to attack other people.
Manage it¶
DNS Manager (dnsmgmt.msc). Right-click the server for server-wide settings; expand Forward Lookup Zones and right-click a zone for zone settings.
Zone transfers¶
A zone transfer sends the entire zone (every hostname and address) to whoever asks. It exists so secondary servers can copy the primary. It should be limited to those servers or turned off.
Zone → Properties → Zone Transfers tab: Only to servers listed on the Name Servers tab, or untick Allow zone transfers entirely.
Registry check: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DNS Server\Zones\<zone>\SecureSecondaries. 0 means anyone; 1 name servers only; 2 listed servers; 3 none.
Dynamic updates¶
Dynamic updates let clients register their own records. Unsecured, anyone on the network can overwrite a record and redirect traffic.
Zone → Properties → General tab → Dynamic updates: Secure only (available for Active Directory-integrated zones) or None.
Registry: AllowUpdate under the same zone key. 0 none, 1 nonsecure and secure, 2 secure only.
Recursion¶
A recursive server looks up any name on behalf of any client. If it does that for the whole internet, it's used in amplification attacks and cache poisoning. A server that's only authoritative for its own zones should disable recursion; one that serves as the LAN's resolver keeps it but should only answer LAN clients.
Server → Properties → Advanced tab → tick Disable recursion (also disables forwarders) if the server is authoritative-only.
Registry: HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\NoRecursion = 1.
Logging¶
Server → Properties → Event Logging tab → All events.
Registry: HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\EventLogLevel not 0.
The service¶
Running, Automatic, if the README says the machine is a DNS server or domain controller (domain controllers need it).
Get-Service DNS | Select Status, StartType
Verify¶
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DNS Server\Zones\corp.local" /v SecureSecondaries
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DNS Server\Zones\corp.local" /v AllowUpdate
reg query "HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters" /v NoRecursion
reg query "HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters" /v EventLogLevel
Example¶
Zone corp.local has Allow zone transfers: To any server and Dynamic updates: Nonsecure and secure. Anyone can download the host list and anyone can overwrite mail.corp.local. Set transfers to name servers only and updates to Secure only.