Skip to content

Unrestricted DNS Zone Transfers

Unrestricted DNS Zone Transfers

Description

DNS Zone Transfers are a mechanism that allows a secondary DNS server to receive a copy of the DNS records from a primary DNS server. While this feature is essential for maintaining DNS redundancy and load distribution, improperly configured DNS servers may allow unauthorized zone transfers, potentially exposing sensitive information about an organization's network infrastructure.

Key points about DNS Zone Transfers:

  • Purpose: Zone transfers are used to replicate DNS data across multiple name servers, ensuring consistency and providing redundancy.

  • Security Risk: If not properly restricted, zone transfers can be exploited by attackers to gather information about an organization's network topology, including internal IP addresses, hostnames, and other sensitive data.

  • Information Disclosure: Successful unauthorized zone transfers can reveal:

  • Internal network structure
  • Naming conventions
  • IP addressing schemes

  • Potential targets for further attacks

  • AXFR Protocol: The primary method for zone transfers is the AXFR (Authoritative Transfer) protocol, which transfers the entire zone file.

  • IXFR Protocol: An alternative is the IXFR (Incremental Zone Transfer) protocol, which only transfers changes made since the last update.

Recommendation

To mitigate the risks associated with unrestricted DNS zone transfers, consider implementing the following recommendations:

  1. Restrict Zone Transfers: Configure DNS servers to only allow zone transfers from authorized secondary name servers.

  2. Use Access Control Lists (ACLs): Implement ACLs on DNS servers to specify which IP addresses are allowed to request zone transfers.

  3. Implement TSIG: Use Transaction Signature (TSIG) to authenticate and encrypt zone transfers between authorized DNS servers.

  4. Use Split-DNS Architecture: Separate internal and external DNS to minimize information exposure.

Practical Steps to Mitigate:

  1. Check for Unrestricted Zone Transfers: Use the dig command to attempt a zone transfer:
dig axfr @ns1.example.com example.com

If the command returns the full zone file, transfers are not properly restricted.

  1. Configure BIND DNS Server: Edit the /etc/named.conf file to restrict zone transfers:
zone "example.com" {
    type master;
    file "example.com.zone";
    allow-transfer { 192.168.1.2; };  // Only allow transfers to this IP
};
  1. Implement TSIG Authentication: Generate a TSIG key:
dnssec-keygen -a HMAC-SHA256 -b 256 -n HOST example-transfer-key

Add the key to your DNS configuration:

key "example-transfer-key" {
    algorithm hmac-sha256;
    secret "BASE64_ENCODED_SECRET";
};

zone "example.com" {
    type master;
    file "example.com.zone";
    allow-transfer { key example-transfer-key; };
};

Standards

  • SOC2_CONTROLS:
    • CC_6_1
    • CC_6_6
    • CC_6_7
    • CC_7_1
  • GDPR:
    • ART_32
  • CCPA:
    • CCPA_1798_150