EC-Council Certified Ethical Hacker (CEH) v12Reconnaissance TechniquesMedium
A security team is reviewing their organization's external footprinting countermeasures. They are particularly concerned about preventing unauthorized parties from mapping their internal network structure by querying their DNS servers. Which of the following is the most critical countermeasure to implement to prevent DNS zone transfers?
- AUse split-horizon DNS for internal and external queries
- BImplement DNSSEC on all public DNS zones
- CDisable recursive queries on public DNS servers
- DRestrict zone transfers to authorized secondary DNS servers only
Show answer & explanationAnswer & explanation
Correct answer: D. Restrict zone transfers to authorized secondary DNS servers only
Restricting zone transfers (AXFR queries) to only authorized secondary DNS servers is the direct and most critical countermeasure to prevent attackers from performing a full DNS zone transfer and mapping the internal network structure. This ensures that only trusted machines can replicate the DNS database.
Why the other options are wrong
- A. Split-horizon DNS separates internal and external views of DNS, which is good for security but doesn't specifically prevent an attacker who has found the external DNS server from attempting a zone transfer.
- B. DNSSEC provides authentication and integrity for DNS data but does not inherently prevent unauthorized zone transfers.
- C. Disabling recursive queries prevents public DNS servers from resolving queries for other domains on behalf of clients, mitigating cache poisoning and amplification attacks, but not directly zone transfers.
DNS Zone Transfer Countermeasures
Security measures implemented to prevent unauthorized parties from performing a DNS zone transfer, which could reveal a complete map of an organization's internal network.
- Primary defense against internal network mapping.
- Involves configuring DNS server access controls.
- Restricts AXFR queries to trusted IPs.
- Essential for footprinting mitigation.
Memory trick: Zone transfers are like giving out your address book; restrict who gets it.