What Is a DNS Server?
A DNS (domain name system) server is a key component of the internet's infrastructure. It translates readable domain names, like example.com, into IP addresses, such as 192.168.10.100, needed by devices to locate resources on the internet. This translation process is essential for users to access websites without memorizing complex numerical addresses, and simplifies machine to machine communication.
DNS servers ensure the correspondence between human-friendly names and machine-recognizable formats. These servers employ a global, distributed database system, working in a hierarchical manner to resolve queries efficiently.
The hierarchical model divides domains into levels, starting from the top-level domain to subdomains. Each DNS server has a role, including caching data for increased speed, redirecting queries to other DNS servers if necessary, and maintaining a record of all requests processed.
This is part of a series of articles about load balancers.
In this article:
DNS acts as the foundation of online communication, enabling billions of devices to locate and connect to services by resolving domain names into IP addresses. If DNS servers were to fail on a large scale, web browsing, email services, cloud applications, and even critical infrastructure systems would become inaccessible, causing widespread disruptions.
At the top of the DNS hierarchy are root name servers, which direct queries to the appropriate top-level domain (TLD) servers. These root servers play a vital role in ensuring that internet traffic flows correctly by maintaining a directory of TLDs like .com, .org, and country-specific domains. Without them, DNS queries would be unable to progress to the next stage of resolution, rendering most of the internet unusable.
The DNS infrastructure is highly distributed and resilient, with millions of authoritative servers, caching resolvers, and root name servers working together to handle queries. This vast network ensures redundancy and reliability, preventing single points of failure from bringing down entire sections of the internet.
Related content: Read our guide to global server load balancing.
DNS servers operate through a systematic process that resolves domain names into IP addresses. To improve performance, DNS servers rely on caching and a hierarchical structure, which ensures queries are resolved quickly.
The DNS resolution process typically involves the following steps:
- User query: When a user types a domain name into a browser, the request is sent to a DNS resolver, which acts as the starting point for the resolution process. The resolver is often managed by the user's internet service provider (ISP).
- Cache check: The resolver first checks its local cache to see if the requested domain has been resolved recently. If the IP address is available in the cache, the resolver immediately returns it to the browser.
- Recursive query: If the cache does not contain the IP address, the resolver initiates a recursive query, reaching out to a root DNS server. Root servers are the top of the DNS hierarchy and direct the resolver to the appropriate top-level domain (TLD) server based on the domain extension (e.g., .com, .org).
- TLD server query: The resolver contacts the TLD server, which provides the address of the authoritative name server responsible for the specific domain.
- Authoritative name server: The authoritative name server contains the DNS records for the domain. It returns the correct IP address to the resolver.
- Response to client: The resolver sends the IP address back to the browser, enabling it to connect to the desired website's server.
Eva Abergel
Eva is a solution expert in Radware’s security group. Her domain of expertise is DDoS protection, where she leads positioning, messaging and product launches. Prior to joining Radware, Eva led a Product Marketing and Sales Enablement team at a global robotics company acquired by Bosch and worked as an Engineer at Intel. Eva holds a B.Sc. degree in Mechatronics Engineering from Ariel University and an Entrepreneurship Development certificate from the York Entrepreneurship Development Institute of Canada.
Tips from the Expert:
In my experience, here are tips that can help you better secure, optimize, and troubleshoot DNS servers:
1. Isolate DNS traffic from general network traffic: Segment DNS-related communication using VLANs or dedicated subnets. This helps contain DNS-based attacks and prevents lateral movement within the network if a breach occurs.
2. Deploy DNS sinkholing for threat mitigation: Implement DNS sinkholing to redirect requests for known malicious domains to a controlled environment. This prevents connections to harmful sites and allows monitoring of infected devices attempting to access them.
3. Implement DNS response policy zones (RPZ): Use RPZ to apply custom filtering rules that block, redirect, or modify DNS responses based on threat intelligence. This approach helps block malware C2 (Command & Control) communications and restrict access to high-risk domains.
4. Use DNS encryption beyond DoH or DoT: While DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt DNS queries between clients and resolvers, further secure the infrastructure by using authenticated encryption within internal networks to prevent internal snooping or tampering.
5. Rate-limit recursive DNS queries per client: Implement rate-limiting to prevent resource exhaustion caused by DNS flood or water torture attacks. Set dynamic thresholds that adapt based on normal traffic patterns for more effective protection.
1. Recursive DNS Servers
Recursive DNS servers act as intermediaries between client devices and authoritative DNS servers, which hold up-to-date IP address information. When a user requests access to a particular domain, the recursive server queries the necessary DNS infrastructure to find the correct IP address. If it doesn't already have the data cached, it goes through a series of queries until it receives an authoritative answer. It then forwards this result to the client.
These servers are essential for providing fast and reliable responses, often caching query results to minimize future query times. Caching reduces redundancy and network congestion by storing frequently accessed addresses.
2. Authoritative DNS Servers
Authoritative DNS servers are the final arbiter of domain names and IP address information. They hold the DNS records for domains, ensuring that queries for these resources return accurate and verified information. When a recursive server reaches an authoritative server, it receives the definitive answer for the domain query.
These servers do not cache data from other domains but retain complete domain records they are responsible for. This distinction reduces downtime and enhances security, as authoritative servers are usually configured with secure records, making them less susceptible to manipulation.
3. Root Name Servers
Root name servers are at the top of the DNS hierarchy and play a crucial role in directing queries to appropriate top-level domain (TLD) authoritative servers. There are 13 logical root servers worldwide, but they are distributed across numerous locations through anycast, which improves redundancy and reduces latency. These servers manage information that helps recursive DNS servers locate the TLD servers, initiating the domain resolution process.
Root servers are vital in maintaining the structural backbone of the DNS system. They do not store complete domain data but have pointers directing queries to the next stage in the DNS hierarchy.
4. Top-Level Domain (TLD) Servers
Top-level domain (TLD) servers are a critical part of the DNS hierarchy, sitting just below root name servers. They manage the next step in the resolution process by directing queries to the authoritative DNS servers for specific domains. Each TLD server corresponds to a particular domain extension, such as .com, .org, .net, or country-code TLDs like .uk or .jp.
When a recursive DNS server contacts a TLD server, it requests information about the authoritative server for the desired domain. For example, if the query is for example.co.uk, the TLD server for .uk will provide the address of the authoritative server for example.co.uk.
TLD servers are maintained by various organizations and registries, such as Verisign for .com and .net, and Nominet for .uk. Their operation is crucial for directing queries accurately and maintaining the scalability of the DNS system.
Because DNS is such a critical infrastructure, it is an attractive target for threat actors. There are several types of attacks that exploit weaknesses in DNS infrastructure.
DNS Tunneling
DNS tunneling is an attack method that exploits DNS queries and responses to transmit malicious data or establish covert communication channels. Attackers encode payloads within DNS requests and responses, allowing them to bypass network security measures that do not inspect DNS traffic thoroughly. This technique is often used for data exfiltration, command-and-control (C2) communications, or bypassing firewalls.
To execute DNS tunneling, an attacker sets up a malicious authoritative DNS server and tricks a compromised system into sending DNS queries to it. The server decodes hidden messages within the queries and sends back data in the DNS responses. Preventing DNS tunneling requires monitoring for abnormal DNS traffic patterns, using security-focused DNS resolvers, and implementing deep packet inspection (DPI) to detect anomalies.
DNS Hijacking
DNS hijacking occurs when an attacker manipulates DNS resolution to redirect users to malicious sites. This can be achieved by compromising a DNS server, modifying local DNS settings on a victim’s device, or using malware to alter DNS configurations.
Attackers often use DNS hijacking to conduct phishing campaigns, steal credentials, or distribute malware. In some cases, ISPs and governments have also used DNS hijacking to censor or redirect internet traffic. Preventing this attack involves using DNSSEC (Domain Name System Security Extensions) to verify DNS responses, keeping routers and DNS configurations secure, and using encrypted DNS protocols like DNS over HTTPS (DoH) or DNS over TLS (DoT).
DNS Spoofing
DNS spoofing, also known as cache poisoning, involves injecting false DNS records into a resolver's cache, causing it to return incorrect IP addresses. This attack allows attackers to redirect users to fraudulent websites that mimic legitimate services, facilitating credential theft and malware distribution.
Since DNS resolvers cache query results to improve speed, a poisoned entry can affect multiple users until the cache expires. Attackers exploit weaknesses in the DNS protocol, such as insufficient randomness in query identifiers. Mitigating DNS spoofing requires using DNSSEC to authenticate responses, implementing random query IDs and source ports, and flushing DNS caches when suspicious activity is detected.
DNS Amplification Attack
A DNS amplification attack is a form of distributed denial-of-service (DDoS) attack that exploits open DNS resolvers to flood a target with excessive traffic. Attackers send small DNS queries with spoofed source IP addresses (belonging to the victim), prompting DNS servers to return large responses to the victim’s system, overwhelming its resources.
Attackers often use queries for DNS records with large responses, such as TXT or ANY records, to maximize amplification. To prevent DNS amplification, organizations should configure their DNS servers to reject recursive queries from unauthorized users, implement rate limiting, and use response rate limiting (RRL) techniques.
DNS Flood Attack
A DNS flood attack is a volumetric attack where attackers overwhelm a target DNS server with a massive number of requests, depleting its resources and making it unable to respond to legitimate queries. Unlike a DNS amplification attack, which exploits open resolvers, a DNS flood directly targets the victim’s DNS infrastructure.
Attackers may generate high query volumes using botnets, sending randomized or valid domain queries at an extreme rate. To mitigate DNS flood attacks, organizations should deploy rate limiting, enable DNS caching, and use traffic analysis tools to identify abnormal spikes in DNS requests.
DNS Water Torture/ Random Subdomain Attack
A DNS water torture attack, also known as a DNS random subdomain attack, aims to exhaust the resources of an authoritative DNS server by flooding it with queries for non-existent subdomains. The goal is to overload the server’s processing capacity and degrade its ability to respond to legitimate queries.
Attackers generate high volumes of random subdomain queries (e.g., abc123.example.com, xyz789.example.com), forcing the authoritative DNS server to attempt resolution repeatedly. To counteract this attack, DNS administrators can implement rate limiting, use DNS firewalls, or configure authoritative servers to drop queries for invalid subdomains.
Phantom Domain Attack
A phantom domain attack targets recursive DNS resolvers by making them waste resources on resolving queries for unresponsive or slow-responding domains. Attackers register domains that either respond extremely slowly or do not respond at all, causing resolvers to spend excessive time waiting for responses. This ties up the resolver’s resources, degrading service for legitimate users.
Phantom domain attacks exploit the recursive nature of DNS and can be difficult to detect. Countermeasures include enforcing query timeout limits, blacklisting known phantom domains, and monitoring resolver performance to detect unusual query delays.
When DNS servers fail, the internet experience for users is disrupted because domain names cannot be resolved into IP addresses. This prevents devices from locating and accessing websites, services, or other network resources. The consequences of DNS server failures include:
- Inability to access websites: Since DNS servers handle domain resolution, their failure means that users cannot reach websites using domain names. Even though the servers hosting the websites are functional, they remain inaccessible without DNS resolution.
- Email and application downtime: Applications like email clients, messaging services, and enterprise tools that rely on domain-based communication may stop functioning properly.
- Slower internet performance: If a DNS server is only partially functioning or experiencing delays, users may encounter slow loading times or connection timeouts as their devices struggle to resolve domains.
- Loss of redundancy: DNS systems typically rely on redundancy with multiple servers available to handle queries. However, if backup servers are also affected, or misconfigurations occur, the entire DNS system can become inaccessible.
- Security vulnerabilities: During DNS failures, some users may attempt to modify their DNS settings to use alternative or public DNS services. In such scenarios, they could be vulnerable to man-in-the-middle attacks or phishing attempts if malicious DNS servers are used.
Here are some of the measures that organizations can take to protect themselves against DNS attacks and ensure uninterrupted service.
1. Regular Updates and Patch Management
New patches often address security flaws that could otherwise be exploited by attackers. Timely application of updates ensures DNS servers operate within a secure environment, minimizing risks like data breaches or service disruptions.
Neglecting patches leaves systems exposed to potential exploits that may compromise network integrity. Integrating automated update systems can simplify this process, ensuring servers receive the latest security enhancements without unnecessary delays. Regular schedules for reviewing and applying patches ensure DNS resilience and stability.
2. Redundancy and High Availability
Redundancy and high availability setups mitigate DNS service disruptions by ensuring alternate servers can take over if a primary DNS server fails. Achieving redundancy involves maintaining multiple, geographically diverse DNS servers that can substitute as needed. High availability configurations strive for uninterrupted operation.
Through methods like anycast routing and geographically distributed servers, organizations can prevent single points of failure, maintaining consistent DNS resolution services. This robustness is especially important in maintaining trust and reliability for end-users. Establishing effective redundancy frameworks is part of strategic DNS infrastructure design.
3. Performance Optimization
Performance optimization for DNS servers involves configuring settings that enhance speed and responsiveness. Measures such as tuning cache sizes, adjusting TTL values, and utilizing fast, geographically proximal DNS resolvers contribute to improved efficiency. Regularly monitoring server performance enables identification of latency issues and permits timely intervention.
Using content delivery networks (CDNs) in conjunction with DNS can further optimize query handling by reducing the distance between users and content servers. By focusing on performance tuning, organizations can ensure that DNS servers deliver rapid responses, essential for maintaining user satisfaction and simplified network operations.
4. Secure Configuration
Securing DNS servers requires configuration strategies that minimize vulnerabilities and resist unauthorized access. Best practices include disabling unnecessary services, implementing access controls, and regularly auditing server logs. Ensuring only essential ports are open and applying firewall rules supports a fortified network perimeter.
Encryption protocols like DNSSEC add further layers of security. Configuring servers to only accept connections from trusted sources and using authentication mechanisms for updates and queries reduce exposure to threats. Secure configurations protect DNS operations and preserve the integrity and confidentiality of the data they manage.
5. Documentation and Change Management
Comprehensive records of configurations, changes, and incident responses enable effective problem-solving and planning. Detailed documentation aids new administrators in understanding prior decisions, assisting in continuity and consistency across DNS management tasks.
Change management processes ensure that updates and modifications undergo careful analysis, minimizing disruption risks. Implementing protocols like version control and automated documentation tools can simplify tracking and approvals. Proper documentation and change management reinforce the reliability of DNS services, supporting stable network operations
Radware ensures the security of DNS resources and prevents DNS attacks through the following products and solutions:
DefensePro X
Radware's DefensePro X is an advanced DDoS protection solution that provides real-time, automated mitigation against high-volume, encrypted, and zero-day attacks. It leverages behavioral-based detection algorithms to accurately distinguish between legitimate and malicious traffic, enabling proactive defense without manual intervention. The system can autonomously detect and mitigate unknown threats within 18 seconds, ensuring rapid response to evolving cyber threats. With mitigation capacities ranging from 6 Gbps to 800 Gbps, DefensePro X is built for scalability, making it suitable for enterprises and service providers facing massive attack volumes. It protects against IoT-driven botnets, burst attacks, DNS and TLS/SSL floods, and ransom DDoS campaigns. The solution also offers seamless integration with Radware’s Cloud DDoS Protection Service, providing flexible deployment options. Featuring advanced security dashboards for enhanced visibility, DefensePro X ensures comprehensive network protection while minimizing operational overhead.
Cloud DDoS Protection Service
Radware’s Cloud DDoS Protection Service offers advanced, multi-layered defense against Distributed Denial of Service (DDoS) attacks. It uses sophisticated behavioral algorithms to detect and mitigate threats at both the network (L3/4) and application (L7) layers. This service provides comprehensive protection for infrastructure, including on-premises data centers and public or private clouds. Key features include real-time detection and mitigation of volumetric floods, DNS DDoS attacks, and sophisticated application-layer attacks like HTTP/S floods. Additionally, Radware’s solution offers flexible deployment options, such as on-demand, always-on, or hybrid models, and includes a unified management system for detailed attack analysis and mitigation.
DNS DDoS Protection
Radware’s DNS DDoS Protection solution safeguards your DNS infrastructure from advanced DNS DDoS attacks. It uses behavioral-based detection and automatic real-time signatures to block attacks, ensuring that your DNS services remain available and your users can access your websites and applications without interruption.
Alteon Application Delivery Controller (ADC)
Radware’s Alteon Application Delivery Controller (ADC) offers robust, multi-faceted application delivery and security, combining advanced load balancing with integrated Web Application Firewall (WAF) capabilities. Designed to optimize and protect mission-critical applications, Alteon ADC provides comprehensive Layer 4-7 load balancing, SSL offloading, and acceleration for seamless application performance. The integrated WAF defends against a broad range of web threats, including SQL Injection, cross-site scripting, and advanced bot-driven attacks. Alteon ADC further enhances application security through bot management, API protection, and DDoS mitigation, ensuring continuous service availability and data protection. Built for both on-premises and hybrid cloud environments, it also supports containerized and microservices architectures, enabling scalable and flexible deployments that align with modern IT infrastructures.