GB/T 33562-2017 in English

DNS Security Technical Guide Interpretation

With the development of network attack technology, DNS vulnerabilities have become a major threat to network security. As the core solution to this problem, the DNSSec protocol requires security extensions to be deployed at every step from the root zone to the final domain name.

Authoritative Domain Name System Security Guide

• Authoritative domain name servers need to be security tested and hardened to ensure that only DNS traffic processing is configured.
• The operating system follows the principle of minimum installation and patches are updated in a timely manner.
• Restrict the source of DNS transaction requests through access control lists (ACLs).

Recursive Domain Name System Security Guide

• Recursive domain name servers need to enhance their ability to support large data packets and improve port randomness.
• Configure the time synchronization service (NTP) to ensure clock consistency.
• Restrict client access rights to prevent cache poisoning attacks.

DNS Security Implementation Recommendations

Based on the GB/T 33562-2017 standard, the following implementation recommendations are for reference:

• Key management strategy: Implement a strict key generation, storage and rotation mechanism to ensure the validity period and pre-release strategy of ZSK and KSK.
• Zone file signature: Regularly check the signature status of the zone file, and perform incremental or complete re-signing in a timely manner to avoid the risk of signature expiration.
• Trust chain establishment: Configure my country's DNSSec trust source as a trust anchor point, and verify the authenticity of the public key through DS resource records.
• Monitoring and response: Establish a DNS security event monitoring mechanism to respond to key leaks and attacks in a timely manner.