Step 5: Secure DNS Zone Transfers
DNS servers distribute information—specifically, computer names and their IP addresses—one record at a time to a client upon request. Because a client needs to ask for the IP address by host name, that data is at little risk of interception. But attackers would love to get their hands on the complete contents of your DNS zones, and that information frequently travels between DNS servers, making it vulnerable to interception.
During DNS server synchronization, NT DNS servers send the complete zone file (in plaintext, as I mentioned earlier) even if just one record has changed. The only way to protect zone transfers between NT DNS servers is through a VPN tunnel or third-party encryption software. Upgrading your DNS servers to Win2K is usually simpler.
Because Win2K DNS supports incremental zone transfer (IXFR) for standard zones, Win2K DNS servers transfer only the records that have changed. This approach greatly reduces the opportunities to intercept an entire zone: Win2K DNS servers send the entire zone only when you add a new secondary DNS server. Zone transfer security is a key reason for implementing AD-integrated zones. These zones transfer DNS information as part of the AD replication process between DCs, so transfers are encrypted as well as incremental. . . .
Register
