DNS Security Checker & Poisoning Defense

The DNS Security Checker provides a comprehensive diagnostic evaluation of a domain's Domain Name System architecture from an offensive and defensive perspective. It checks whether the zone implements DNSSEC to prevent cache poisoning, confirms that authoritative servers block unauthorized AXFR zone transfers, and tests for dangling records vulnerable to hijacking.

By probing authoritative nameservers, this tool identifies whether your infrastructure could be abused as an open recursive resolver for DNS amplification DDoS attacks or if unencrypted DNS communications expose your users to man-in-the-middle manipulation.

Historically, DNS queries and responses operated entirely in unencrypted plaintext UDP packets without cryptographic authentication. In 2008, security researcher Dan Kaminsky demonstrated how easily attackers could flood recursive resolvers with forged UDP responses containing guessed 16-bit transaction IDs, successfully poisoning the resolver's cache. Once poisoned, all subsequent users requesting a banking or corporate website were silently redirected to attacker-controlled phishing servers.

DNS Security Extensions (DNSSEC), formalized in RFC 4033-4035, eliminates this threat by adding digital signatures to DNS records using public-key cryptography. In a DNSSEC-enabled zone, each record set (RRset) is accompanied by an RRSIG signature generated by a Zone Signing Key (ZSK). Recursive validating resolvers verify this signature against a Chain of Trust anchored in the Internet Root Key, ensuring any tampered or spoofed DNS response is rejected.