4

I have a remote dedicated server running Windows Server 2012 R2. It's a single server hosted in a datacenter. We've had no end of issues with the DNS service being reported for committing abuse due to exploits.

So I would love to be able to just turn the DNS off completely. I’m 90% sure we don't need it. However, I’m not 100% sure. We access the server remotely using Remote Desktop Connection, and it hosts some web APIs via IIS and a couple of other services, such as SVN.

Would it be safe to disable the DNS service?

7

Without access to the server it's quite hard to tell exactly if it's needed or not, but it sounds like you're running a public DNS server since it's been targeted by exploits.

The only reason to run a DNS server on the public Internet is to serve records, so I'd be surprised if someone set it up correctly without any need for it.

The best place to start is to investigate the DNS records of your domains.

For example, let's say your company owns the domains example.com and example.org. Check that both domains name server records (NS) doesn't point to that particular server.

Another way to check this same thing is to open mmc.exe on the server and adding the DNS snap-in. Look under Forward Zones to see what kind of records the server is configured to serve.

| improve this answer | |
  • Or, block inbound port 53 (DNS) and you're done? Why bother with anything else? – SnakeDoc Aug 13 at 22:54
  • 2
    @SnakeDoc, because if the server is the authoritative DNS server for a domain, it effectively knocks that domain off the Internet. – Mark Aug 13 at 23:20
  • That would be quite a rare setup these days, and OP would likely be aware of that situation if true. It's more likely whoever installed the server just selected a bunch of roles they thought would be helpful, which led to an open-responder DNS server running on the box. OP's other option would be to limit inbound Port 53 to just their office IP address/range, which would prevent this problem too. Seems the box is running internal stuff mostly anyway. – SnakeDoc Aug 13 at 23:25
  • 2
    @SnakeDoc Even if it's just an accidental case of having it set up, it's still better to just unprovision it instead of simply blocking the port. Less software running on your system equals less attack surface and fewer possibilities of resource exhaustion. – Austin Hemmelgarn Aug 14 at 1:53
  • 1
    @SnakeDoc All the more reason to run as few things as possible! – Austin Hemmelgarn Aug 14 at 12:41
6

It sounds like DNS Recursion is enabled, fortunately it is an easy one to answer:

  • Check for any Forward or Reverse Lookup Zones.
  • If there are any forward zones, check the nameserver records at the registrar for those domains, and make sure they are not pointed to the DNS server.
  • If they are not, turn off DNS completely.
  • If they are, disable recursion on the server.

Before doing the last two, make sure you change the server’s DNS server IP address(es) in the network configuration to alternate servers, as more often than not when a DNS server has recursion enabled, it will resolve records to itself.

| improve this answer | |
-1

Since you are not certain if you need DNS service or not, the only way to find out is stop the local DNS service and see if any operations are hammered. Just have a look before stopping if localhost is used for DNS resolving; it could be needed for connecting. In such a case use another dns server for resolving, check Internet access, and proceed with stopping local DNS service.

| improve this answer | |
  • 1
    You don’t just turn off a service and see if any operations are “hammered”. You need to go through it and determine if the service is being used prior to even opening the Role Services Wizard to uninstall the DNS Server role. Your answer also does not provide any other information on top of the two answers provided. – Christopher H Aug 13 at 19:07
  • I routinely stop services and wait for complaints! 9 out of 10 are completely unnecessary. No waste of resources, less security hassle. Happy servers :) – Krackout Aug 13 at 19:28
  • 1
    If you need to stop services to determine their usage or lack thereof, I’d shoot the person who wrote your IT policies and documentation. If everything is well-documented properly and thoroughly, you would never need to just turn-off a service to check it’s usage. – Christopher H Aug 13 at 19:32
  • 3
    Stopping services just to see if something stops working is the last step after you've verified in every conceivable way you can think of that the service is not being used, not the first step. – Stuggi Aug 13 at 21:13
  • 2
    @Stuggi Exactly. It's the final step and we call it a "scream test." After doing everything possible to avoid service outages, the last thing to do is notify everyone we're stopping the service(30 days out, then 72 hours in advance). A final notification is sent at the time we turn it off, then we wait to see if anyone screams at us. – Booga Roo Aug 13 at 22:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.