Protecting DNS servers in Active Directory

We've already established in my previous tip that if your DNS infrastructure is damaged or attacked, your entire AD infrastructure will probably fail along with it. Protecting your DNS servers will require a multi-pronged

Requires Free Membership to View

approach. First and foremost, establish the same secure design, implementation and deployment procedures for your DNS servers as I've recommended for your AD DCs.

Next, consider implementing secured communications with DNS servers, monitor all network traffic, and re-evaluate the open ports on your firewall.

By encrypting all communications between DNS servers and all DNS clients (which includes not just end user clients but also AD DCs and member servers), it will minimize or eliminate the possibility of traffic interception and manipulation. One of the best ways to implement this is through IPSec. One of the primary benefits to IPSec in addition to encrypted data transmission is mutual authentication of both communication partners (i.e. the DNS server and the DNS client) through a PKI certificate based identity structure before DNS traffic is actually allowed. To implement such a plan, all DNS servers will need to have an IPSec policy of Secured Server (Require Security) or similar enforced. This will also require that all DNS clients have a Client (Request Security) IPSec policy or similar enabled on them. In this way, all DNS communications will be protected by IPSec but non-DNS communications (or at least communications with servers not hosting DNS servers) will not necessarily be protected by IPSec.

The implementation of IPSec across all systems will cause a measurable decrease in the performance of network communications due to the overhead of encrypting and decrypting communications. However, the increased security should more than compensate for the slight reduction in throughput.

In the next tip, I'll discuss the other two options for improving DNS security on an Active Directory network.

James Michael Stewart is a partner and researcher for ITinfopros, a technology-focused writing and training organization.

This was first published in July 2004

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.