We've already established in my previous tip that if your DNS infrastructure is damaged or attacked, your entire AD infrastructure will probably fail along with it. Protecting your DNS servers will require a multi-pronged
Next, consider implementing secured communications with DNS servers, monitor all network traffic, and re-evaluate the open ports on your firewall.
By encrypting all communications between DNS servers and all DNS clients (which includes not just end user clients but also AD DCs and member servers), it will minimize or eliminate the possibility of traffic interception and manipulation. One of the best ways to implement this is through IPSec. One of the primary benefits to IPSec in addition to encrypted data transmission is mutual authentication of both communication partners (i.e. the DNS server and the DNS client) through a PKI certificate based identity structure before DNS traffic is actually allowed. To implement such a plan, all DNS servers will need to have an IPSec policy of Secured Server (Require Security) or similar enforced. This will also require that all DNS clients have a Client (Request Security) IPSec policy or similar enabled on them. In this way, all DNS communications will be protected by IPSec but non-DNS communications (or at least communications with servers not hosting DNS servers) will not necessarily be protected by IPSec.
The implementation of IPSec across all systems will cause a measurable decrease in the performance of network communications due to the overhead of encrypting and decrypting communications. However, the increased security should more than compensate for the slight reduction in throughput.
In the next tip, I'll discuss the other two options for improving DNS security on an Active Directory network.
James Michael Stewart is a partner and researcher for ITinfopros, a technology-focused writing and training organization.
This was first published in July 2004