TL;DR
An attacker has poisoned your authoritative DNS server with records having very long Time-To-Live (TTL) values. This makes the bad data persist for a long time, even after you fix it. We’ll cover how to reduce TTLs quickly and safely, plus steps to monitor and prevent future attacks.
Understanding the Problem
When an attacker compromises your DNS server, they can insert incorrect records (e.g., pointing a domain to their malicious site). The TTL determines how long caching resolvers (like ISPs’ servers) store these records before checking for updates. High TTLs mean it takes much longer for the correct information to propagate when you fix the issue.
Mitigation Steps
- Reduce TTLs Immediately: This is your first priority. Lowering the TTL on all records will shorten the time resolvers cache incorrect data.
- Zone File Editing: Edit your zone file(s) and reduce the default TTL to a low value (e.g., 300 seconds / 5 minutes). The exact method depends on your DNS software (BIND, PowerDNS, etc.).
- Example (BIND): In your zone configuration file (e.g.,
db.example.com), change the SOA record’s TTL and any default TTL settings.$TTL 300 ; Default TTL for all records in this zone - Apply Changes: Reload or restart your DNS server to apply the new configuration. Be careful – a full reload is usually preferred over a restart if possible.
rndc reload example.com - Verify TTL Propagation: Use online tools to check the current TTL for your domain’s records from various locations.
- Tools: What’s My DNS, DNS Checker
- Check Key Records: Focus on A records, MX records, and any other critical entries.
- Correct the Poisoned Records: Identify and fix the incorrect DNS records inserted by the attacker.
- Review Zone File: Carefully examine your zone file(s) for unauthorized changes. Compare against known good backups if available.
- Restore from Backup (if necessary): If you have a clean backup, restoring it might be faster than manually correcting records. However, ensure the backup is recent and trustworthy.
- Increase TTLs Gradually: Once you’ve confirmed the correct records are propagating, slowly increase the TTL values back to their original settings.
- Monitor Propagation: Continue monitoring TTL propagation after each increase.
- Stagger Increases: Increase TTL in stages (e.g., 300s -> 600s -> 1200s -> 3600s) to minimize the impact of any potential issues.
- Implement DNSSEC: DNS Security Extensions (DNSSEC) adds cryptographic signatures to your DNS records, making it much harder for attackers to tamper with them.
- Complexity: DNSSEC can be complex to set up and maintain. Consult documentation specific to your DNS software.
- Benefits: Significantly improves the security of your DNS infrastructure.
- Enhance cyber security Monitoring: Implement tools to detect unauthorized changes to your DNS records.
- Log Analysis: Regularly review DNS server logs for suspicious activity (e.g., unexpected record updates).
- Intrusion Detection Systems (IDS): Configure an IDS to alert you to potential DNS attacks.
- DNS Change Monitoring Tools: Consider using specialized tools that monitor your DNS records for changes and notify you of any discrepancies.
Important Considerations
- Caching: Remember that even after fixing the records, resolvers will continue to cache old data until their TTL expires.
- Backups: Maintain regular backups of your DNS zone files.
- Access Control: Restrict access to your DNS server configuration to authorized personnel only. Use strong passwords and multi-factor authentication where possible.