Is Source Port Randomization Enabled on AWS Route53?

0

Use Route53 to resolve the name of the Internet from EC2 etc. inside the VPC.
I think that source port randomization is effective as a countermeasure against DNS cache poisoning.
So I would like to know if it is enabled in Rotue53.

질문됨 3년 전488회 조회
2개 답변
0
수락된 답변

Source port randomization is a feature which clients use when querying DNS resolvers and which DNS resolvers use when querying DNS authorities. It is indeed a standard mitigation for cache poisoning. The Route 53 Resolver in your VPC, in common with pretty much all modern resolvers, does use source port randomization when querying authorities.

If you are very concerned about cache poisoning, you might also be interested in enabling DNSSEC validation in your VPC, which allows cryptographic validation of responses, if the domain you're querying is DNSSEC signed. See the Route 53 Resolver documentation:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dnssec-validation.html

I would suggest being a little careful enabling DNSSEC validation. Occasionally third party public domains may have broken signatures. If that is the case, enabling DNSSEC validation will (by design) cause DNS resolution to fail for those domains.

AWS
전문가
gavinmc
답변함 3년 전
0

Thanks for your help.

답변함 3년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠