What is Passive DNS? A beginner’s guideAugust 13, 2018
Passive DNS has been an industry standard tool for more than a decade, but given the conversations we are having with various customers, IT teams & security teams, it’s apparent that there is some uncertainty as to what Passive DNS is, and also how it can help businesses protect both their networks and brand.
What is Passive DNS?
Until the introduction of Passive DNS there was no way to retrieve the content of any DNS zone owned by other people as system administrators were not keen to share them. Also, once a change was made to a DNS record the previous details were gone forever as the new version immediately propagated across the internet…. Not very helpful if you need to research all the domain names a suspect IP address has resolved to historically, and vice versa.
Where does Passive DNS data come from?
When a client queries a local DNS resolver and the answer is not included in the server’s cache, then the DNS resolver will query an external root server, followed by the top-level domain (TLD) server and the authoritative name server itself to get access to the requested information (see diagram ).
With special probes activated on the DNS resolver, it is possible to record the packets containing the answers to the client, along with the time & date stamp of when the query was made.
Passive DNS does not store which client (or person) made a query, just the fact that at some point in time, a domain has been associated with a specific DNS record . This ensures that privacy is maintained throughout the system.
Deteque utilises Passive DNS data from Spamhaus, which is collected across the internet globally, from trusted third parties including hosting companies, enterprises, business & ISPs.
With the constant increase in the number of TLDs, there are currently more than 1,000, there is a huge amount of data to record. Deteque’s Passive DNS cluster handles more than 200 million DNS records per hour and stores hundreds of billions of record per month, allowing you to search this vast database easily.
How can this help your IT security?
Passive DNS data provides a wealth of information for IT security teams, research teams and brand protection specialists. Research analysts gain insight as to how a particular domain name changes over time and how it is related to other domains and/or IP addresses. This data enables you to build a picture of potential threats across global networks that simply cannot be identified from monitoring your own network.
Brand protection specialists can identify spoofed domains/websites, noting when they have been active and how they are associated with other domains.
Discover the value this tool can bring to multiple roles:
Passive DNS is an extremely clever and simple to use tool that’s a great addition to your security arsenal.