DNS threats: distinguish reflection traffic from resolution failures
Review recursive resolvers, authoritative DNS and mitigation paths as separate systems.
Contents of this article
Identify the DNS role
Authoritative servers answer for zones, recursive resolvers query for clients, and an application host may simply be a traffic target. Reflection abuse is not synonymous with every DNS timeout. Map query direction and affected interfaces first.
Restrict recursive service appropriately
RFC 5358 addresses misuse of recursive resolvers in reflection attacks. Check whether recursion is unintentionally available to arbitrary external clients and restrict it to the intended audience. Public authoritative service still needs to answer legitimate queries.
Test resolution and service access separately
Track lookup success, latency, query types, packet rate and service connectivity. A working lookup with a congested application calls for forwarding-path analysis; lookup failures call for authoritative service, delegation and DNSSEC checks.
Validate across independent networks
After a change, verify relevant records from independent trusted networks, including caching and fallback behavior. Confirm required protocols and whether DNS itself is in mitigation scope. A restored homepage does not validate every hostname or client.