DNS security: DNSSEC, Unbound, DoT and DoH
You sign a BIND zone with DNSSEC, run a validating resolver with Unbound, and learn to use encrypted DNS and watch for DNS-based threats.
Level 301 · 16 lessons · 15 practice labs
Lessons
DNS threats
- DNS threats: poisoning, hijacking, exfiltration
- Cache poisoning and source port randomisation
- Zone transfer risks and TSIG
- Short task: allow zone transfers only to the secondary
DNSSEC
- DNSSEC: the chain of trust, DNSKEY, DS, RRSIG
- Signing a zone with BIND
- Key rollover: ZSK and KSK
- Solving validation failures with delv and dig +dnssec
- Short task: sign your zone and pass it through a validator
The resolver
- A validating resolver with Unbound
- DoT and DoH: encrypted DNS
- Blocking malicious domains with RPZ
- DNS query logging and monitoring
- Catching DNS tunnelling from query patterns
- Short task: set up a protective DNS service for a company
Wrap-up
- Capstone: secure a company’s internal and external DNS
Practice labs
- The whole zone is handed to anyone: Show with dig axfr that zone transfers on your own lab DNS server are open to anyone, restrict allow-transfer to the secondary only and prove the test is refused.
- The secondary is not getting updates: Protect the transfer between primary and secondary with a TSIG key, resolve the key-name or algorithm mismatch and show the secondary updating when the serial increases.
- Internal names leak from the external DNS: Find transfer, version and internal-record leaks in Blue Harbour Cargo’s external DNS, separate the internal and external views and prove that only the records meant to be public are visible from outside.
- Sign the lab zone: Generate keys for the given zone in BIND, sign it and show RRSIG and DNSKEY records coming back with dig +dnssec.
- The chain breaks at the parent: Add the signed child zone’s DS record correctly to the lab parent zone and show the answer arriving with the ad (authenticated data) flag at the validating resolver.
- A ZSK rollover without an outage: Roll the ZSK of the Harborview Hospital zone using pre-publication, accounting for TTLs at each step, and prove with timestamped queries that validation never broke during the process.
- SERVFAIL: the signatures have expired: Inspect the name returning SERVFAIL at the validating resolver with delv, find the expired signatures, re-sign the zone and show the answer recovering.
- The key changed but the DS stayed old: Spot the mismatch between the parent’s DS and the child’s KSK from the key tags, publish the correct DS and validate the chain end to end.
- Some names resolve, some do not: Find three DNSSEC faults in the lab zone that mask each other (broken NSEC chain, clock skew, wrong algorithm), fix them all and add the evidence output for each to a report.
- A validating resolver for the office: Set up Unbound as a DNSSEC-validating resolver serving only the internal network and show a deliberately broken test name being rejected.
- Queries leave in clear text: Make Unbound forward to its upstreams over DNS over TLS with certificate name checks enabled, and prove the capture shows 853/tcp instead of 53/udp.
- Block malicious domains company-wide: Build an RPZ zone from the given threat list for Windy Ridge Energy, attach it to the resolver, log blocked queries and show a legitimate subdomain is not blocked by mistake.
- Who sends the most queries?: Turn on the resolver’s query log and extract per-client query counts and the most-queried domains from an hour of records.
- Long, meaningless subdomains: Use subdomain length and randomness in the given DNS capture to find the client suspected of tunnelling and report the domain it uses with your reasons.
- Rebuild the leaked file from DNS: From the DNS exfiltration traffic replayed in your own lab network, order the encoded chunks, rebuild the file and write a monitoring rule that would catch the pattern.
About this course
You sign a BIND zone with DNSSEC, run a validating resolver with Unbound, and learn to use encrypted DNS and watch for DNS-based threats.
What you will learn
- DNS threats
- DNSSEC
- The resolver
- Wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.