Using DNS as a layer of defense
summary
Argues that applying DNS RPZ as a recursive-resolver firewall stops phishing and C2 lookups by returning NXDOMAIN or sinkholing, using Bind/Unbound/PowerDNS or Pi-hole and cheap hardware like a Raspberry Pi. Describes building and running feeds/zone files, central master/slave distribution, logging to ELK, and facing significant 100+ networks deployment lessons: many false positives, need for curated feeds, measurable drop in malicious resolution, and challenges from DoH centralization.
AI-written summary · about
chapters (4)
related talks
02h 04mProtective DNS – Why It Matters and How to Deploy It On-prem
19mNames and Security
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
34mPractical Steps for Reducing Exposure and Detecting Compromise
58mMultivariate Solutions To Emerging Passive DNS Challenges
43mBlock DNS exfiltration with dnsmasq proxy
52mCalloused DNS: doing it right
26mMisuse of DNS, the Second Most Used Protocol