so my name is Karen Jacobson I'm going
to try and talk to you about making uh
DNS sort of less suck I suppose is the
best way of describing it
DNS is one of these underappreciated
Services
um well we we don't really appreciate it
until it goes down and then we realize
how stuffed we are
uh we're in a world of pain and last
year was a year of significant DNS
outages with almost every major service
provider having some sort of outage
April was Microsoft and Azure related
Services last year uh July we saw Ori
called UPS FedEx steam LastPass and the
Playstation Network down because there
was an issue with Akamai DNS
September slack went down most
developers realized that that was a
lovely holiday
in October the internet basically melted
because Mata and Facebook Instagram
messenger and WhatsApp all became
available due to some routing changes
that made matters DNS Services no longer
respond
uh and then finally in December last
year AWS went down and was issues with
aws's DNS services provider or DNS
Services I should say
um and that took down a whole bunch of
other providers and a whole bunch of
other services that all relied on that
as well
but it's not just outages when it comes
to DNS that makes it suck
DNS attacks are growing more frequent
every year the most common that we're
still seeing is compromise credentials
Brute Force credentials to try and get
in and start making changes to DNS zones
and DNS portals
uh but there's another one that's
starting to become more frequent
especially as we're starting to move
more to devops and really agile
deployment strategies and that's called
dangling DNS entries
so what's a dangling DNS entry
let's take a look at the scenario where
we go ahead and provision an Azure
service
we call it app dash conto great Dash
dev001 Dot azurewebsites.net
we're also going to assign a cname to it
greatapp.contoso.com
after some time we decide we no longer
need that service so we just go into the
Azure portal and we delete it
uh the problem we've now got is that
we've got this dangling entry we have
we've still got that c name of great app
pointing through to that Azure website's
address
after a period of time
some sort of threat actor comes along
and see that's available and what they
do is they provision another app service
using that same great great app Dash app
dash control great Dash dev-001.
azurewebsites.net
they might put some malicious content on
there
um and so what they've now got is
they've got an opportunity to use your
company's brand the domain name that is
part of your corporate brand to start
launching attacks against maybe it's you
could be your customers could be all
sorts of things
um
these sorts of attacks are really
powerful when it comes to trying to do
targeted phishing attacks
your employees are used to seeing and
going to sites and services that is name
dot company name.com so if I was to send
them an email that said go and click on
this link and log into
greatapp.contoso.com they're more likely
to fall victim to those sorts of attacks
the other challenge is that if I've got
these sort of access
um cookie harvesting attacks cross-site
scripting
um cause attacks there's a bunch of
other browser attacks we can actually
start to launch on the end user as well
why is this a problem what comes down to
Brand damage and reputation damage and
that's stuff that's very difficult to
repair long term
so how do we go about trying to make
this process better how do we make it
suck less
um the stack exchange team over the
years they manage quite a large DNS
infrastructure
um and they developed DNS control and
that's based upon their experience with
DNS and their experience going through
multiple DNS provider outages
and along with the community they built
DNS control and it uses an
infrastructure as a code approach it
uses JavaScript as a DSL that you can
use to describe your domain name and the
zone and all the records within it
not only can you use it to describe the
Zone but you can then use it to push the
settings out to production it supports
40 or 50 different DNS providers and you
can have it Go and create entries delete
entries or even modify entries in your
Zone
the other thing is using my little
pointer here you can see what's a D mark
entry you can see that I've got some CIA
records and you can see the a records so
it's really clear what's what I've got
comments that say this is the production
website you know this is the records for
office 365.
so then when it starts to come to that
process of well what's this record for
or what's that record for it starts to
close the gap it's easier for us when
we're going back six years later and
going through a DNS Zone to know what we
can and can't delete
so let's say I wanted to make a change
uh and I've these are some screenshots
from an old conference presentation but
say I wanted to create a record called
hello.planetpowershell.com and then have
the contents as some sort of Hello
message
all I have to do is use my favorite
editor say vs code to go in and edit the
dnscontrol.js file put the extra records
in
and then go ahead commit those to a
branch push that up to GitHub create a
pull request and in this case I'm just
doing it all in get cracking
once I've got that pull request set up I
can then start to do a pull request
review
most devs in the room pretty comfortable
with this
what's really handy with DNS control is
it also gives us functionality and
features to be able to verify the
contents and test that that file is
valid using the check command but we can
also get a preview of what changes it
would make if we told it to using the
test command the preview command sorry
and so I can build those into my my
um GitHub uh checks my pull request
checks
um and then as part of that review I can
actually go in and take a look at the
the build so to speak and I can see the
preview and go okay yep if we Commit
This to the main branch and have it be
deployed to prod it's going to create
this entry for us
and so if I was to merge that to main
um
I could then simply go ahead and start
to use the DNS control push command and
that will actually make those changes
and I can watch in real time as in my
cloud in my DNS provider's console the
changes are made and then of course
after an arbitrary period of time I'll
also be able to see that those records
have become available using a tool like
MX toolbox
but there's also other ways that DNS
control starts to make things more
simple
genius records aren't the easiest things
to understand and create there's a lot
of complicated syntax normally
so what DNS control has is it has these
builders that help accelerate and make
the process easier
the first is the SPF record Builder
normally this is a text file with a
whole bunch of weird lines it's kind of
complicated to write the Builder allows
us to make a nice neat separate files
the Builder also has some features to
help us when we start to hit some of the
limits of SPF records
you might not know it but you could only
have a maximum of 10 DNS queries in your
SPF record so we often have to do this
trick called flattening when we go and
do the queries and sort of build out 10
magic records that fits all the IP
addresses so our email works
this is all built in a DNS control it
does it all for you so it's really
lightening the load on your
administrators your Ops teams to do this
work
another entry that's kind of hard to
build is your dmac entries
it's you know plus uh Dash you know this
Dash this dash dash this it's it is a
tricky thing with the dmarc builder we
actually can talk in terms of policies
instead of P equals
um you know we can start to make these
entries a little bit more easy to
understand
and just some quick links before I
finish up because I'm almost out of time
I did a hour-long version of this
session at Linux conferu at the start of
the year
um that video is up online I've got some
links here also on actually starting a
journey to migrate to DNS control and
also set up the CI CD processes
um I've also got a repo that's like a
you know a starting Place sort of a
template for DNS control as well and
also check out DNS controls own
migration guide
thank you