An Integrity Verification Scheme for DNS Zone file based on Security Impact Analysis Ramaswamy Chandramouli NIST, Gaithersburg, MD 20899 (mouli@nist.gov ) Scott Rose NIST, Gaithersburg, MD 20899 scott.rose@nist.gov Abstract The Domain Name System (DNS) is the world’s largest distributed computing system that performs the key function of translating user-friendly domain names to IP addresses through a process called name resolution. After looking at the protection measures for securing the DNS transactions, we discover that the trust in the name resolution process ultimately depends upon the integrity of the data repository that authoritative name servers of DNS use. This data repository is called a zone file. Hence we analyze in detail the data content relationships in a zone file that have security impacts. We then develop a taxonomy and associated population of constraints. We also have developed a platform-independent framework using XML, XML Schema and XSLT for encoding those constraints and verifying them against the XML encoded zone file data to detect integrity violations. 1. Introduction The domain name system (DNS) is the world’s largest distributed computing system that enables access to any resource in the Internet by translating user-friendly domain names to IP Addresses. The process of translating domain names to IP Addresses is called Name Resolution. A DNS name resolution is the first step in the majority of Internet transactions. The DNS is in fact a client server system that provides this name resolution service through a family of servers called Domain Name Servers. The hierarchical domain space is divided into administrative units called zones. A zone usually consists of a domain (say example.com) and possibly one or more sub domains (projects.example.com, services.example.com). The authoritative data needed for performing the name resolution service is contained in a file called the zone file and the DNS servers hosting this file are called the authoritative name servers for that zone. The DNS clients that make use of the services provided by authoritative name servers could be of two types. One type is called a stub resolver that formulates and sends a query every time it receives a request from an application that requires Internet service (e.g., a browser). The other type is called a caching (also called recursive/resolving) name server that caches the name resolution responses it has obtained from authoritative name servers and thus able to serve multiple stub resolvers. The zone file hosted on an authoritative name server consists of various types of records called Resource Records (RRs). Associated with each DNS resource record is a type (RRtype). The code for these RRtypes is assigned by an international organization called Internet Assigned Names Authority (IANA). An RR of a given RRtype in a zone file provides a specific type of information. Some of the common RRtype codes are: NS, MX and A. An NS RR in a zone file gives the fully qualified domain name (FQDN) of the host that is considered the name server for that zone. For example, an NS RR in the zone file of the zone example.com gives the information that the host ns1.projects.example.com is a name server for the domain projects.example.com. Similarly an MX RR gives the host name for a mail server for the zone. An A RR gives the IP address for a host in a domain within the zone. A zone file generally consists of multiple RRs of a given RRtype with some exceptions (e.g., there can be only SOA RR in a zone file). It can also have multiple RRs for the same domain name and same (or different) RRtype (e.g., multiple name servers or mail servers for a domain say services.example.com). The DNS infrastructure consists of many different types of DNS servers, DNS clients and transactions among/between these entities. The most important transaction in DNS is the one that provides the core service of DNS (i.e., name resolution service) and is called the DNS Query/Response. A DNS Query/Response transaction is made up of a query originating from a DNS client (generically called a DNS resolver) and response from a DNS name server. The response consists of one or more RRs. These RRs may be served from its own zone file (for an authoritative name server) or from a cache of RRs obtained from other name servers (for a