1. How it works
Why it needs to be secured
June 13th 2016
By Michael McLean

2. Why did I choose this subject?
I’m a history buff

3. DNS defined
 DNS stands for Domain Name System
 Maps user friendly domain names to IP addresses
 DNS is organized in a hierarchical structure
 Used on TCP/IP networks to locate resources

4. A brief history of DNS
 The first form of name resolution was done using a
hosts file.
 A centrally managed hosts file was used by ARPANET
from 1973 – 1984.
 Today the hosts file can still be found on client
machines at
%Systemroot%WindowsSystem32DriversEtc

5. History continued
 Before DNS email used “Source Routing.”
 Below is an actual communication path of the old email routing system
called “source routing.” Note that a bang or “!” separates the individual
sites linked in the hops along the path to the destination. The “grg”
tagged at the end was the actual destination user name.
 utzoo!decvax!harpo!eagle!mhtsa!ihnss!ihuxp!grg
 DNS was invented in 1983 by Paul Mockapetris at
USC’s Information Science Institute.
 DNS was not implemented until 1984.

6. Domain Name System Hierarchy
A properly written fully qualified domain name in a DNS
zone file will have a terminating dot or period on the end.
Such as:
www.lwtech.edu.

7. Why does DNS need to be secure?
 If authoritative DNS servers are compromised there
can be global consequences.
 Hackers will also try and compromise the registration
of a domain to gain access to the DNS servers assigned
to that domain.
 DNS cache can be altered maliciously to provide
fraudulent responses. This DNS spoofing attack
maliciously places an incorrect IP address into a DNS
resolvers cache.

8. DNS Secure Extensions
 DNSSEC guards against cache poisoning such as the
Kaminsky Bug
 DNSSEC will validate DNS responses to be from a
trusted source using the digital signatures generated
by zone signing
 The digital signature returned with the DNS response
validates data integrity
 Digital signatures can be generated on DNS servers
containing DNS zones that have had DNSSEC applied
to them

9. DNSSEC Defined
 DNSSEC works with a trust level that works from the
top down starting at the root zone or the dot [.]
 The root zone verifies the top level domains
 The top level domains verify the second level domains.
 DNSSEC name servers use public key signing keys and
public zone signing keys that are signed by private key
signing keys.
 To be able to authenticate and validate a DNS
response, DNSSEC uses asymmetric public and private
key cryptology and digital signatures

10. Protocols of DNSSEC
 Un-secured DNS uses the UDP protocol
 Secure DNS uses TCP which requires a TCP 3 way
handshake
 Both UDP and TCP need to be enabled on port 53
 DNSSEC does not provide encryption. DNSSEC provides a
chain of trust
 DNSCrypt provides encryption and can work together with
DNSSEC. DNSCrypt does not use SSL.
 DNSCrypt uses elliptic-curve cryptography
 Elliptic curve cryptography (ECC) is an approach to public-
key cryptography based on the algebraic structure of
elliptic curves over finite fields

11. Sources
 Image for Dwight D. Eisenhower:
http://content.time.com/time/covers/0,16641,19600104,00.html
 http://searchnetworking.techtarget.com/definition/ARPA
 https://dnscrypt.org/
 https://en.wikipedia.org/wiki/Hosts_(file)
 http://www.livinginternet.com/i/iw_dns_history.htm
 https://en.wikipedia.org/wiki/Paul_Mockapetris
 http://www.itgeared.com/articles/1354-domain-name-system-dns-tutorial-
overview/
 http://www.securityweek.com/five-dns-threats-you-should-protect-against
 https://www.cloudflare.com/dnssec/how-dnssec-works/
 https://en.wikipedia.org/wiki/Elliptic_curve_cryptography
 https://technet.microsoft.com/en-us/library/cc787920(v=ws.10).aspx
 https://technet.microsoft.com/en-us/library/cc775637(v=ws.10).aspx