Monitoring, analyzing and cleaning DNS configuration errors across European NRENs Slavko Gajin University of Belgrade, Serbia Petar Bojović Faculty of computer science, Union University in Belgrade,

TNC2013 Introduction – Why DNS? DNS – the first and still basic infrastructural network service Must be always up and running Multi-redundant DNS is “boring” for net admins, comparing to other newer services Usually works well, at least nobody complains… Do ALL our DNS serves work well? DNS testing tools: DIG can give all the answers… … but highly difficult to cross-check and analyze lot of textual data DNS Squish, DNS Sleuth, DNS Stuff, DNSgoodies… ICmyNet.DNS Test all DNS serves involved in resolution of the specified domain, including all servers on all parent domains Free online service –

TNC2013 Example – ICmyNet.DNS Proper DNS configuration

TNC2013 Example - ICmyNet.DNS Server is not responding

TNC2013 Example - ICmyNet.DNS Server is not responding

TNC2013 Example - ICmyNet.DNS Unsynchronized SOA

TNC2013 Example – ICmyNet.DNS Non-authoritative server

TNC2013 Example – ICmyNet.DNS Loops

TNC2013 Security issues March, 2013, AMRES 5 DNS servers with open resolver (recursion) were used for massive DDoS attack - DNS Amplification Attacks April, 2009, AMRES One DNS server was used for attack to 9 DNS servers December, 2012, RS TLD Register was broken, ~80 popular domains were hacked January, 2001, Microsoft all the authoritative servers became inaccessible

TNC2013 What we have done? Number of DNS checks are defined with compliances to RFC standards and recommendations: UDP/TCP response Authority Parent servers refer to non-authoritative server Parent servers do not refer to authoritative server (Stealth) Resolution loop - referral answer from non-authoritative server Consistency with the parent servers Glue Record A records are inconsistent Public zone transfer Recursion (Open resolver) SOA Synchronization timers MX records A records for WWW and the domain IPv6 - AAAA records DNSSEC

TNC2013 What we have done? Application for massive DNS checking is developed Special attention and policy was applied not to overload any DNS servers and network > domains collected from 31 European NRENs NREN domains are checked during February, 2013 The most interesting results are presented, summarized by NRENs NREN names are shown on the summary statistics

TNC2013 Results – Domain numbers > domains collected from 31 European NRENs Sources: Many NRENs responded and sent domains – Thanks! Web sites - NRENs, universities, ministries… Public Zone Transfer Sorry if some domains are missing…

TNC2013 Results – Unavailable domains Unavailable domains were skipped Only available domains were used for the statistic

TNC2013 Results – Non-operating DNS servers Domains with at least one non-operating DNS server, but defined in the parent zone: Non-responding DNS server over UDP on port 53 Non-authoritative DNS server for the domain Consequence Queries end up the server, but without resolution (timeout or referral)

TNC2013 Results – Problem on the parent level Domains with at least one DNS server: Authoritative but not defined on the parent level – “Stealth” Authoritative but not accessible via some parent server (some parent server is unavailable) Consequence: The server is partially or totally hidden for the resolution (useless)

TNC2013 Results – Recursion and PZT Domains with at least one DNS with: Recursion (Open resolver) Public Zone Transfer Consequence: Compromised security

TNC2013 Results – Server locality Domains with all DNS servers in /24 subnet Consequence: Potential single point of failure (LAN segment)

TNC2013 Results – No MX record Domains with no MX record

TNC2013 Results – Mail servers Domains with MX records where: Several mail server names are pointing to the same IP address Inconsistent IP address A record in the domain zone and resolved IP address

TNC2013 Results – No A record Domains with no A record: For WWW name For domain itself Web site is not accessible with the domain name only (“ must be typed in the browser)

TNC2013 Results – IPv6 – AAAA record Domains with AAAA record - for IPv6 access: For WWW name For domain itself

TNC2013 Results – DNSSEC Domains with applied DNSSEC options: On parent level Protected NS records Protected MX records Protected A records Protected AAAA records

TNC2013 Results – Non-responding over TCP UDP is basic operating mode for DNS TCP is needed for packets with >4000 Bytes of data DNSSEC

TNC2013 More examples Miss-configuration in local zone Not all properly configured parent servers resolve properly !

TNC2013 Cleaning DNS errors in AMRES March, 2013, AMRES – cleaning the mess (192 domains) Focused to the most serious problems Proper functionality Security Applied methodology: List all domains and servers regarding the specific errors Manual check and analysis for each domain – ICmyNet.DNS Start with parent zones and servers Majority of errors can be fixed on this level ! Direct communication with DNS administrators Slow process, not always successful Update internal database for domains and responsible persons Improve changing - trying to keep the configurations consistent Improve process for opening new domains

TNC2013 Cleaning DNS errors in AMRES ProblemBeforeAfter Recursion (Open Resolver) 58.85%15.66% Public Zone Transfer 61.11%12.12% Non-responding UDP 4.04%1.01% Non-authoritative 11.62%5.56% Auth. Server (Stealth) 3.03%2.02% Problem with some parent server 7.07%3.54%

TNC2013 What could be next? Spread awareness about DNS problems before they appear Motivate other NRENs to initiate DNS clean-up process We can cooperate with other NRENs by providing detailed reports Domain and server lists Improve the application to permanently monitor domains Access to DNS admins interested in the process Permissions to manage domains, change settings, schedule tests, automatic notifications, reporting…

TNC2013 Acknowledgment RNIDS – Register of National Internet Domains of Serbia Sponsoring the research by co-financing the scholarship of PhD student Petar Bojovic Analysis for all RS and СРБ domains On-line checking tool tailored for “ordinary” domain owners

TNC2013 Questions ?