If you need to set up DNS monitoring and verify the authenticity of the DNS responses, you can configure the Custom Script monitoring device and use the DnsSecTest.cs script.

The DnsSecTest.cs script enables DNSSEC validation for DNS lookup.

What Is DNSSEC Validation?

DNSSEC is a suite of extensions that improve Domain Name System (DNS) security by verifying that DNS results have not been tampered with. Enterprises can use DNSSEC to prevent a number of attacks related to DNS spoofing, DNS cache poisoning, etc.

Security was not a top priority during the development of the DNS. Therefore, when sending a request to an authoritative DNS server, the resolver cannot verify the authenticity of the response, sent by name servers to clients. The resolver can only check if the response comes from the same IP address to which the original request was sent.

DNSSEC helps to verify the authenticity of DNS responses by using digital signatures for DNS records.

Configuring DnsSecTest.cs

Custom Script File Arguments
DnsSecTest.cs <Domain/hostname> <recordType> <DnsServersUsage>

DnsSecTest.cs available parameters:

  • <Domain/hostname> – Domain or host name to resolve.
  • <recordType> – NS record type to query. Available values: Any, Uri, A, Ns, CName, Soa, Wks, Ptr, HInfo, Mx, Txt, Rp, Afsdb, X25, Isdn, Rt, Nsap, Sig, Key, Px, GPos, Aaaa, Loc, Srv, Naptr, Kx, Cert, DName, Opt, Apl, Ds, SshFp, Ipseckey, RrSig, NSec, Dnskey, Dhcid, NSec3, NSec3Param, TIsa, Hip, CDs, CDnskey, OpenPGPKey, CSync, NId, L32, L64, LP, Eui48, Eui64, TKey, TSig, Ixfr, Axfr, MailB, CAA, Dlv.
  • <DnsServersUsage>Optional: Type of DNS Server to use. Available values: Auto, IPv4Only, IPv6Priority.

Examples

Example Response Details
1.   2021-10-19 04:18:10.071 DOTCOM-MONITOR STEP. Is IPv6 enabled for DNS servers: False
2.   2021-10-19 04:18:10.075 DOTCOM-MONITOR STEP. Request to 192.36.148.17 : Dns request #48085
 Question: [ microsoft.com. Ds INet ]
Flags: [IsRecursionDesired: False, IsCheckingDisabled: True, IsDnsSecOk: True ] 

3.   2021-10-19 04:18:10.102 DOTCOM-MONITOR STEP. Response from 192.36.148.17: Dns response #48085 RCode: NoError
 Question: [ microsoft.com. Ds INet ]
Flags: [IsAuthenticData: False, IsAuthoritiveAnswer: False, IsCheckingDisabled: True, IsDnsSecOk: True, IsEDnsEnabled: True, IsRecursionAllowed: False, IsRecursionDesired: False ] 
Answer records:
Additional records:
m.gtld-servers.net. 172800 IN A 192.55.83.30
l.gtld-servers.net. 172800 IN A 192.41.162.30
k.gtld-servers.net. 172800 IN A 192.52.178.30
j.gtld-servers.net. 172800 IN A 192.48.79.30
i.gtld-servers.net. 172800 IN A 192.43.172.30
h.gtld-servers.net. 172800 IN A 192.54.112.30
g.gtld-servers.net. 172800 IN A 192.42.93.30
f.gtld-servers.net. 172800 IN A 192.35.51.30
e.gtld-servers.net. 172800 IN A 192.12.94.30
d.gtld-servers.net. 172800 IN A 192.31.80.30
c.gtld-servers.net. 172800 IN A 192.26.92.30
b.gtld-servers.net. 172800 IN A 192.33.14.30
a.gtld-servers.net. 172800 IN A 192.5.6.30
m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30
l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30
k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30
j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30
i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30
h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30
g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30
f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30
e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30
d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30
c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30
b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30
a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30
; EDNS version: 0; flags: DO; udp: 4096
Authority records:
com. 172800 IN NS b.gtld-servers.net.
com. 172800 IN NS c.gtld-servers.net.
com. 172800 IN NS f.gtld-servers.net.
com. 172800 IN NS k.gtld-servers.net.
com. 172800 IN NS l.gtld-servers.net.
com. 172800 IN NS g.gtld-servers.net.
com. 172800 IN NS m.gtld-servers.net.
com. 172800 IN NS i.gtld-servers.net.
com. 172800 IN NS d.gtld-servers.net.
com. 172800 IN NS h.gtld-servers.net.
com. 172800 IN NS e.gtld-servers.net.
com. 172800 IN NS a.gtld-servers.net.
com. 172800 IN NS j.gtld-servers.net.
com. 86400 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766
com. 86400 IN RRSIG DS 8 1 86400 20211101050000 20211019040000 14748 . UfGIF9LAypJoSmK9wAphO+ve/I8iQqQkjmNsxCha6UdKX3O+oPTxDU32wEuajMlf873yjZ+FkBxKH+Crl2MLBTkcbmYV7E3rIZdmGeqKkPnOq/R0JkuQdk4BbxRvyJhf+OKW+PrlX6gP2r8Q387eGTxQPuxPMblLELlto5NTnqaXYME4QD63W/UrSqNDWWL1/UYmJ+UaJhn/Dp0d+QT6wooM0yPJaRMo5xd476vPXg5aXAcJhp/3g4jEB0CovicJfqyxBWOKcscYPNiq1z1EXiRtXsrWoy46uWhPaJqCpkHHmpus6XM8M4Ojuk1lxFnkBUARk0Co6MHRH/Evsxr9dQ==

4.   2021-10-19 04:18:10.102 DOTCOM-MONITOR STEP. Request to 192.55.83.30 : Dns request #7170
 Question: [ microsoft.com. Ds INet ]
Flags: [IsRecursionDesired: False, IsCheckingDisabled: True, IsDnsSecOk: True ] 

5.   2021-10-19 04:18:10.147 DOTCOM-MONITOR STEP. Response from 192.55.83.30: Dns response #7170 RCode: NoError
 Question: [ microsoft.com. Ds INet ]
Flags: [IsAuthenticData: False, IsAuthoritiveAnswer: True, IsCheckingDisabled: True, IsDnsSecOk: True, IsEDnsEnabled: True, IsRecursionAllowed: False, IsRecursionDesired: False ] 
Answer records:
Additional records:
; EDNS version: 0; flags: DO; udp: 4096
Authority records:
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A NS SOA RRSIG DNSKEY NSEC3PARAM
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20211023042336 20211016031336 15549 com. Gw3gWAHJ0mo6ongxQgBkfV4GtTMyIgXoPv6oZsKbRBJsIMXSlICn5/sU7TlEUdMfmzV+crrVV5VRlFZYgIQn8T5Nk/eDH8nxREYJNBsZ3JU6AEJzNVH70wWpmyIUtMlGV9ZiFx83tuaa+d
...
...
...