Lesson 5

Planning DNS Security

4-53

data, so a potential intruder cannot use IP spoofing to impersonate a domain controller.

In addition, Active Directory encrypts all traffic, which prevents anyone capturing the

packets from reading the data they contain. Finally, access to the domain controllers

themselves is restricted by the policies you already have in place to protect your other

Active Directory data.

Planning If you cannot use Active Directory–integrated zones on your network, you must

create standard file-based zones and use zone transfers to replicate the DNS namespace

data. Although zone transfers are inherently less secure than Active Directory replication,

there are still techniques you can use to prevent intruders from intercepting your DNS data.

One way to protect zone transfer data is to specify the IP addresses of the DNS servers

that you allow to participate in zone transfers. If you do not do this, a potential intruder

can simply install a DNS server, create a secondary zone, and request a zone transfer

from your primary zone. The intruder then has a complete copy of your zone and all

the information in it. To limit zone transfers on a Windows Server 2003 DNS server, you

open the DNS console, display the Properties dialog box for a primary zone and then

click the Zone transfers tab to display the dialog box shown in Figure 4-15. Select the

Allow Zone Transfers check box and then choose either the Only To Servers Listed On

The Name Servers Tab or the Only To The Following Servers option button. You can

then specify the IP addresses of the DNS servers that contain your secondary zones, in

either the IP Address text box or the Name Servers tab.

Exam Tip

Be sure to understand the various methods of securing zone transfer traffic and

!

the conditions under which zone transfers are necessary. For example, Active Directory-inte-

grated zones do not need to be replicated using zone transfers.

F04pm15

Figure 4-15

The Zone Transfers tab in a DNS zone’s Properties dialog box