安全 DNS：DNSSEC 与基于 HTTPS 的 DNS（DoH）

DNS 安全挑战

DNS 缓存投毒

# DNS cache poisoning simulation
# Attacker floods resolver with forged responses
# for the query 'A example.com?'

# Each response guesses a different transaction ID:
# ID=1234: example.com -> 198.51.100.1  (attacker IP)
# ID=1235: example.com -> 198.51.100.1
# ...
# ID=XXXX: example.com -> 198.51.100.1  (correct guess!)

# Resolver caches poisoned answer (TTL = 3600s)
# All users querying this resolver get attacker IP
# Users are redirected to phishing/malware server

DNSSEC：DNS 安全扩展

# Verify DNSSEC signature on a domain
dig +dnssec example.com A
# Look for 'ad' (authenticated data) flag in response
# and the RRSIG record alongside the A record

# Query for DNSKEY record
dig DNSKEY example.com

# Query for DS record at parent zone
dig DS example.com @a.iana-servers.net

# Full DNSSEC chain validation check
dig +sigchase +trusted-key=/.../root.key example.com A

DNSSEC 密钥类型：KSK 和 ZSK

DNSSEC 的局限性

基于 HTTPS 的 DNS（DoH）

# DoH query using curl
curl -H 'accept: application/dns-json' \
  'https://cloudflare-dns.com/dns-query?name=example.com&type=A'

# DoH query via RFC 8484 (binary format)
curl -s -H 'Content-Type: application/dns-message' \
     -H 'Accept: application/dns-message' \
     --data-binary @query.bin \
     https://dns.google/dns-query

# Configure Firefox to use DoH
# about:config -> network.trr.uri
# Set to: https://mozilla.cloudflare-dns.com/dns-query

基于 TLS 的 DNS（DoT）

# Test DoT connection using kdig
kdig -d @9.9.9.9 +tls-ca example.com A

# Test DoT using openssl
openssl s_client -connect 1.1.1.1:853
# Then type: query string in DNS wire format

# Configure systemd-resolved to use DoT (Linux)
# /etc/systemd/resolved.conf:
[Resolve]
DNS=9.9.9.9#dns.quad9.net
DNSOverTLS=yes

DoH 和 DoT：企业注意事项

# Enterprise DoH bypass prevention
# Windows Group Policy:
# Computer Config > Admin Templates > Google Chrome
# 'DNS over HTTPS mode': Disabled
# 'DNS over HTTPS URI templates': <empty>

# Firewall: block known public DoH resolvers
iptables -I FORWARD -d 8.8.8.8 -p tcp --dport 443 -j DROP
iptables -I FORWARD -d 1.1.1.1 -p tcp --dport 443 -j DROP
iptables -I FORWARD -d 9.9.9.9 -p tcp --dport 443 -j DROP
iptables -I FORWARD -d 149.112.112.112 -p tcp --dport 443 -j DROP

# Redirect all DNS to corporate resolver
iptables -t nat -A PREROUTING -p udp --dport 53 \
  -j DNAT --to-destination 10.0.0.53:53

DNS 安全实践

DNS 隧道检测

# DNS tunneling detection indicators
# Flag queries with:
# 1. Query name > 100 characters
# 2. More than 50 queries/minute from single host
# 3. High-entropy domain labels (base64/hex patterns)
# 4. TXT or NULL record type queries (unusual)
# 5. Queries to domains with no web presence

# Example tunnel query (encoded payload)
# aGVsbG8gd29ybGQ.vGhpcyBpcyBkYXRh.evil-domain.com
# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# Base64 encoded 'hello world this is data'

DNS 响应策略区域（RPZ）

# BIND RPZ configuration snippet
# /etc/named.conf
response-policy {
  zone 'rpz.spamhaus.net';
  zone 'local-blocklist.internal';
};

# RPZ zone file (local-blocklist.internal)
$ORIGIN local-blocklist.internal.
@  SOA  ns1.company.com. admin.company.com. 2024010101 3600 600 86400 300
botnet-c2.evil IN CNAME .   # NXDOMAIN response
phishing-site.com IN A 10.0.0.99  # Redirect to sinkhole

快速检查

课程回顾