Avoiding DNS Pain
summary
DNS outages and attacks rise year on year with real incidents at Azure, Akamai and AWS and one global outage that exposes fragility; dangling DNS entries (CNAMEs and MXs left pointing to deleted cloud resources) allow name takeover and phishing. The proposed fix is DNSControl, a JavaScript DSL that runs check and preview, has a SPF optimizer, supports Cloudflare/Azure/AWS providers, integrates with Git/GitHub PRs and CI for fast, auditable changes and provider migration, and is shown creating records successfully in production.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:10DNS Pain
- 3:40DNS Security
- 7:48DNS Change Control
- 8:57DNS Zones
- 10:14DNS Control
- 12:38Example
- 16:24Other cool features
- 18:15Provider resilience
- 21:36Links
- 24:45Questions
related talks
10mAvoiding DNS Pain
38mCloud-Squatting: The Never-ending Misery Of Deleted & Forgotten Cloud Assets
19mCloudy with a Chance of Cyberattacks: Dangling Resources Abuse on Cloud Platforms
34mPractical Steps for Reducing Exposure and Detecting Compromise
34mIt’s Always DNS: So Let’s Break It On Purpose
29mMaginotDNS: Attacking the Boundary of DNS Caching Protection
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
39mProject Dusseldorf: Finding Out-Of-Band Vulnerabilities At Cloud Scale