0

I work with an isolated/airgapped global network with several redundant domain controllers which also act as DNS servers. My question is, I hope, pretty simple, but I seem to be having a hard time finding anything on Google that applies to our setup.

Is there a best practice for dealing with external internet DNS requests coming from systems on an isolated network?

For Background:

We recently identified that a large portion of our network bandwidth is being utilized by DNS, specifically UDP traffic on port 53 between the different DNS servers. We can verify this by enabling DNS debug logging where we see hundreds of megabytes of DNS traffic every hour on all of our DNS servers. We know the main culprit to be McAfee's GTI/Artemis protocol where they try to send hashed file data to avts or avqs.mcafee.com via DNS requests. We're getting the McAfee problem fixed by dealing with the McAfee software on our network, but I was concerned with how the DNS requests are being forwarded between our different DNS servers. It appears that our DNS servers are just forwarding the requests for any external site to a different DNS server in our network. This process appears to last forever, or at least for a very long time (more than 30 minutes for one specific request that I tracked through the DNS debug logs). The request gets sent from Server 1 -> Server 2 -> Server 3 -> Server 1 etc. I'm trying to get together some data to propose a change to people in charge of configuration management, because right now it appears that something is clearly not configured properly.

Using Windows Server 2008 R2.

Improve this question
3
  • 2
    It appears that our DNS servers are just forwarding the requests for any external site to a different DNS server in our network. - Then you need to look at the forwarding configuration on each DNS server. – joeqwerty Mar 24 '18 at 16:58
  • Do DNS requests not timeout after being forwarded a certain number of times? The only thing I can find is a timeout period of 3 seconds for a server that isn't responding. – David Breeden Mar 24 '18 at 17:02
  • There's no limit for the amount of additional queries, but eventually the recursive queries will cause the initial request to timeout after 3 seconds. – Esa Jokinen Mar 24 '18 at 17:22
3

If all dns servers are internal only and zones are replicated, you should have no forwarders and no root hints, external lookups will receive either NXDOMAIN or SERVFAIL once from it's local resolver (your DC).

See Disable Recursion

Improve this answer
1
  • 1
    I think this is honestly the way to go, as long as we have replication (which we do) then I can't think of a reason to use recursion, hopefully the change management guys agree! – David Breeden Mar 24 '18 at 19:24
0

If the problem is software attempting to resolve avqs.mcafee.com make a zone for avqs.mcafee.com and resolve the traffic to a blackhole box.

Improve this answer
5
  • At that point make a zone called . – Jacob Evans Mar 24 '18 at 18:13
  • That would also work. – user5870571 Mar 24 '18 at 18:14
  • Wouldn't zone "." also deny queries sent to a FQDN? – David Breeden Mar 24 '18 at 20:13
  • It would respond to all requests do you would nest the FQDN under the “.” zone. – user5870571 Mar 24 '18 at 20:14
  • There are many ways you can implement the concept presented in our answers. – user5870571 Mar 24 '18 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.