Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am probably completely wrong but what seems as the standard way to point a domain to a site is very insecure.

Say your domain is regestered with Company A and your site is hosted through Company B.

The steps to set it all up are usually:

  • Login to Company A and set the DNS record for my-domain.com to point to ns1.company-b.com and ns2.company-b.com
  • Login to Company B and add my-domain.com to your account and set up an A record.

But how does Company B know that you are authorized to set up an A record? Just because the domain is using their DNS server? Isn't it possible that someone else who is a customer of Company B is really the owner of the domain and they are the ones that pointed it to Company B's DNS servers -- And since you are also a customer of Company B you can just hijack the domain?

This may not be possible, if so, what is preventing something like this from happening?

share|improve this question
    
I'm confused. What does Company B have to do with your DNS? They're hosting your web site, right? So why would you be setting up DNS records there? In addition, as Avery stated, if Company B is not authoritative for your DNS zone then the worst they could do would be to poison DNS clients that use them for DNS, if they provide that service. –  joeqwerty Dec 2 '11 at 3:58

5 Answers 5

up vote 8 down vote accepted

In theory, you are correct. In practice, this isn't really a security issue because you have control over what the domain uses as authoritative name servers. So, say I have set up records for your domain at Company B. You go to set up records and their interface won't allow you to (because a DNS server can't have multiple zone files active for the same domain), or you notice records are already set up. You immediately go to company A again and set your authoritative name servers to point somewhere else, then you talk to company B. Company B knows you are the one who owns the domain, not the other customer, because A) your information is in the WHOIS database associated with the domain and B) you can demonstrate control over the domain via setting the authoritative name servers. Likely, they then proceed to suspend the other customer for their nefarious deeds.

This isn't something you should spend a lot of time worrying about.

share|improve this answer
1  
+1 "...this isn't really a security issue because you have control over what the domain uses as authoritative name servers". Spot on. –  Avery Payne Dec 2 '11 at 3:54
1  
+1 for that last sentence. –  John Gardeniers Dec 2 '11 at 4:19

You should do the steps in the other order. Set things up at company B and confirm that you have added the domain to your account before you point the nameservers over. That way, the attack window is zero. But even if you don't do that, it's still a very narrow window and easily solved by calling company B (or just pointing the nameservers away).

share|improve this answer
    
I have never tried but based on your answer it seems once someone has set up the A record at company B, it then becomes locked so no other user can set it up again afterwards and overwrite the first (yours)? –  JD Isaacks Dec 1 '11 at 18:23
    
I guess there is no way to answer my comment since that would be decided by the company but it seems that would be the secure thing to do. –  JD Isaacks Dec 1 '11 at 18:32
    
@JohnIsaacks Yes. If not, that's a big problem. –  David Schwartz Dec 1 '11 at 18:36

Simple. Only the authoritative server matters.

I can set up DNS for google.com on my servers at home, and make it look like google, and fiddle with it all day long, redirect and capture traffic from my kids, etc. etc., but as long as clients are actually asking the root servers for the authority for the zone, it won't matter what I have set up...because the authoritative server determines this, and will return the correct address records back to the client.

Yes, you could create poisoned DNS entries and all that, but sooner or later, the TTL on those entries will expire, and unless you can directly control the client's resolver address, the client will run out to the root servers, the root servers will point them to the correct server (the authoritative server), and the jig's up. Even if you use another DNS service, that service will sooner or later cache the correct entries.

In the case of company B in your example, you can set up the records all you want. Unless clients query that server, it won't matter. If they do query it directly, then that's another matter, but even that won't last forever, and when the TTL expires, the DNS dance will happen all over again...directing them to the correct server.

The key here is the DNS server registered with the root. Whatever the root thinks is the IP address of the server(s) that are authoritative for your domain, well, that's where people will go to get answers. If you are concerned about someone hijacking the domain name while "in transit", that's something best resolved by using the tools provided by the DNS service to transfer the domain over. They will handle all of that for you. When they do, they will set up their service as the authority for your zone with the root servers.

If you are concerned about someone trying to register the domain again, then DNS is fundamentally horked, and the internet is borken (not broken, but BORKened). It just doesn't happen that way.

share|improve this answer

But how does Company B know that you are authorized to set up an A record? Just because the domain is using their DNS server?

Yes it because you've added company B's name server for your domain.

Isn't it possible that someone else who is a customer of Company B is really the owner of the domain and they are the ones that pointed it to Company B's DNS servers -- And since you are also a customer of Company B you can just hijack the domain?

When you register a domain there you provide Administrative / Registrant Name , contact  details email address etc. So a second person can only become owner of your domain only if it is authorized by the domain administrative contact to that person.
share|improve this answer
    
Either I am misunderstanding you or you are misunderstanding me. What I meant was, you still own the domain through Company A. However, another customer of Company B (who has no account with company A) finds out your domain points to Company B's name servers. So they log in to their account, add your domain to their account, and set an A record for your domain to their malicious website. You still technically own your domain and can change the DNS record but in the mean time users are being redirected to another website (in theory.) –  JD Isaacks Dec 1 '11 at 18:21
1  
In the scenario you reference, generally software controls prevent a domain from being added to two different accounts. So when Client B goes to Company B and tries to set up Yourdomain.com, it will fail with a "this domain already exists" error. –  Driftpeasant Dec 1 '11 at 19:26

Before you can create any records on company B's nameservers, someone there must authorize you to. You should ensure you have that authority before changing your name servers to point to their server. Once company B is hosting your nameservers you are dependent on their security to ensure that unauthorized persons can not change your DNS records.

Just because your site is hosted on company B's server you do not need to host your DNS with them. You could just as easily setup the necessary A record on company A's servers. It is common for smaller sites to have all their DNS records hosted by their domain registrar. (When you first setup your domain the registrar would be company A in your example.) The registrar will always be the source for looking up the authoritative name server records.

It is also common that a third company hosts the nameservers. In this case you would depend on their security to prevent others from changing your DNS records.

As long a you have the authority to update your records with the domain registrar you can always move your name servers to a different company in the case your DNS records get hijacked. Due to DNS caching, it may take some time to redirect your DNS A records to the correct locations.

PTR records are a different matter. These are always controlled one of the organizations which supplied the IP address(es). It is possible for them to delegate control of particular addresses via CNAMES.

It is now possible to increase the security of your domain records using DNSSEC. This allows you to sign your DNS records. Not all clients will check the signatures, so it does not protect your domain records for all clients.

Local DNS spoofing is always possible. Some people use local spoofing to block traffic from ad sites. There are a number of site lists available which are intended to be used for this purpose.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.