DNS Security Assessment

This guide treats authoritative and recursive DNS services as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Identify authoritative nameservers and the organization responsible for each zone.

2. 02

   Collect A, AAAA, CNAME, MX, NS, TXT, CAA, SOA, and DNSSEC context.

3. 03

   Separate public authoritative service from internal recursive resolvers.

4. 04

   Check for wildcard records, stale delegation, and unexpected external dependencies.

dig +short NS example.com
dig +short MX example.com
dig +short TXT example.com
dig +short CAA example.com
dig +dnssec example.com SOA

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Confirm zone transfers are restricted using a designated test zone or explicit approval.

2. 02

   Verify recursion is unavailable to untrusted networks.

3. 03

   Review DNSSEC chain status and key-rotation ownership.

4. 04

   Validate SPF, DKIM selectors, DMARC alignment, and CAA against documented mail and certificate providers.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Monitor new records, delegation changes, certificate-related records, and unusual query volume.
• Preserve resolver and authoritative logs according to privacy policy.
• Alert on unexpected dynamic updates and high-risk record changes.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Restrict recursion and zone transfers.
• Remove stale records and dangling delegations.
• Use controlled DNS change workflows with review and rollback.
• Monitor DNSSEC validity and email-authentication policy drift.