BI.ZONE Secure DNS
However, DNS traffic is almost never tracked. Commonly used security solutions such as firewalls, IDPS
Adversaries often take advantage of this blind spot to steal data, manage malware, and direct users to phishing websites.
Our solution helps IT and security teams control enterprise DNS traffic while ensuring its transparency
The solution provides full visibility of your DNS traffic, including DNS over TLS and DNS over HTTPS, and blocks traffic‑related threats
Role: application firewall to control DNS queries
BI.ZONE Secure DNS prevents your staff from opening phishing links, accessing malware resources, and breaching corporate security policies
Role: DNS filter
DNS events for analysis are reduced by more than 99% with only blocked threats sent to the SIEM
Role: DNS gateway with cleansed data for monitoring
Query caching and geobalancing via BGP Anycast eliminates DNS availability issues
Role: recursive resolver
The solution identifies threats that are not visible to other network security tools: cache poisoning, DNS tunneling
Information from the BI.ZONE Threat Intelligence portal helps to intercept malicious queries before they even reach the adversary’s infrastructure
Detailed DNS traffic data helps companies of all sizes address IT and cybersecurity tasks
You can choose the option best suited for your needs: cloud, on‑prem, or hybrid
The cloud option can be connected in several minutes, the hybrid option takes as little as one day
Personal account
Try it out
- Write to us
-
We will arrange a demo meeting and answer your questions
-
We will help you throughout the 30-day trial period
You might also need
Cloud
Hybrid
On-prem
The latest update enhances transparency, accuracy, and efficiency of DNS traffic management. Key improvements include revised analytics interface, integration and threat detection capabilities.
- Advanced DNS tunnel detection. BI.ZONE Secure DNS now more accurately detects hidden illegitimate traffic transmitted via DNS tunneling. With the new algorithms, you can:
- identify attempts to transfer data through blocked tunnels
- detect idle activity on compromised devices with higher precision
- reduce false positives when analyzing Do53, DoH, DoT, DoQ, and EDNS0
- Updated AI model for DGA domain detection. The model now better distinguishes legitimate domain generators (e.g., Microsoft, Google) from malicious ones, reducing false positives and the risk of overlooking real threats.
- Product management via REST-like API. Particularly useful for larger businesses and MSSPs leveraging BI.ZONE Secure DNS as part of their security system. New API capabilities include the following:
- automated configuration and management of filtering policies
- export of statistics
- integration with external systems
New monitoring panel in personal account. Facilitates faster identification of network traffic anomalies with customizable dashboards and an expanded set of metrics, including:
- number of DGA and DNS tunnels, and the traffic transmitted through them
- number of DNS queries with applied filtering policies
- average query and response times, and DNS protocol details
- most frequently allowed domains and IP addresses
- DNS response codes and extended DNS errors
In the new version, domain name resolution is faster, and DNS filtering can be configured both via the API and directly through your personal account.
- Doubled performance. BI.ZONE Secure DNS now processes more DNS queries and responses with the same efficiency.
- Faster data retrieval from the BI.ZONE Threat Intelligence portal. The solution sends a single verification request for multiple domains collected within a certain period rather than an individual request for each domain. This reduces verification time and load for both solutions.
- Faster transfer of latest threat data. Such information can now be exchanged between BI.ZONE cloud nodes and your infrastructure nodes via the EDNS0 protocol extension. This speeds up block/allow resolutions.
- Optimized DNS-over-HTTPS (DoH) transmission. Offers improved message buffering with more stable DoH interaction.
- DNS cache entry invalidation. Regularly clears second-level cache, ensuring data reliability in case of emergencies.
- DNS cookie support. Provides extra protection against DNS spoofing by automatically setting DNS cookie values when calling the BI.ZONE Secure DNS authoritative server. This prevents an adversary from spoofing the domain name resolution.
- Configuration via personal account. Previously, the only way to configure DNS filtering was via the API. Now you can use your personal account to manage black and white lists, the BI.ZONE Threat Intelligence integration module, and the detection/blocking of DNS tunnels from DGAs or DNS rebinding.
- Redirection list. In addition to allowing/blocking certain domains, you can now redirect users to a different IP (e.g., a warning page when attempting to access gambling or other restricted websites).
- Monitoring list. Enables you to track queries of interest with minimal effort.
The latest update introduces new DNS traffic control mechanisms and personal account capabilities.
- New DGA detection method. Ensures a more precise identification of advanced domain name generation techniques used by malware to obfuscate C2 domains. The method’s ML algorithms leverage the data from 100 C&C utilities and frameworks as well as malware test results.
- Enhanced DNS tunnel detection algorithms. Mitigates the risk of data theft through EDNS0 DNS tunnels. Following a series of tests, we were able to expand the list of DNS tunneling tools detected and blocked by BI.ZONE Secure DNS to include Sliver, Pupy RAT, Metasploit, White Snake, and over 10 others.
- Reduced resolution time and higher performance. Reduces domain name resolution time to 5–10 ms with the single responsibility approach, and domain name security verification time to 20 ms through enhanced integration with the BI.ZONE Threat Intelligence portal. These updates triple the solution’s performance and even further improve its fault tolerance.
- Event logging system. Your personal account now displays all allowed domains, DNS queries and responses, enabling the monitoring of visited websites, attacks, and other suspicious activity.
- Advanced reporting. Reports leverage event log data and new statistics, including traffic volume, query source IPs, the most widespread dangerous domains, DNS tunnels, and more. The My Reports tab supports scheduled and custom reports for any period.
- Public APIs for solution management. DNS filtering settings can now be managed through the GraphQL API.
- Personal account for on-prem deployment. Earlier on-prem versions only allowed CMD solution interactions. This update introduces a personal account interface for convenient access to statistics.
The Domain Name System converts human readable domain names into IP addresses; for instance, https://bi.zone into 185.163.159.90. This format is more convenient for machine processing while users do not have to memorize long strings of numbers.
There are currently more than 342 million registered domains
When you type a URL in the search box, the browser queries the servers in the DNS infrastructure to find the IP address associated with the domain name. The number of iterations depends on the presence of the IP address in the server’s temporary memory (cache), on the domain extension, etc.
DNS servers are organized in a tree hierarchy:
- Root domain servers. There are thirteen servers like that, each being a distributed set of replicas with the same IP address. Queries are routed to the closest root server to make sure they are redirected to the respective web resource zone.
- Top level domain (TLD) servers. For example, if you want to open
bi.zone, the query goes to the TLD server which maintains information about the domain names with the&nbdsp;.zoneextension. - Authoritative DNS servers. They are responsible for a specific DNS zone and store data about particular websites, applications, or online services. If an authoritative server does not have information about the domain, it returns an error and the browser reports that such an address cannot be found.
- Recursive DNS server. Even though the last in the hierarchy, this is actually the first stop for the user’s query. This server is also known as a resolver or a caching DNS server. It receives DNS queries from user applications and provides a response if the requested domain is cached, or, otherwise, queries the next level server.
Let us assume you want to access the bi.zone website. You enter the address (domain name), and the browser checks with the resolver which IP address corresponds to this character set.
If the resolver does not find the requested resource in the cache, it queries the root DNS server. The root DNS server responds with the IP address of the TLD server that contains records about the website’s domain extension (.zone). The TLD server then returns the address of the authoritative DNS server to the resolver, and the latter finally provides the IP address of bi.zone.
After receiving the address from the DNS server, the browser opens the website.
DNS-related threats can be categorized into two groups:
DoS/DDoS attacks that aim to disrupt the normal operation of the corporate DNS server. As a result, the company’s website or web application becomes unavailable: the browser cannot receive the IP address of the queried resource. Examples of such attacks include ICMP flood
, NXDOMAIN , phantom domain , domain lockup . To protect against this category of attacks, a secondary DNS server is used. It acts as an authoritative DNS for the domain extension and processes queries instead of the protected DNS server. An example of such a solution is BI.ZONE AntiDDoS.
-
Attacks that leverage the specific features of the DNS protocol to spoof or hijack data. For instance, an attacker can redirect a user to a fake website or send a command to a malicious program to retrieve sensitive data from an infected device.
You can block such attacks by implementing solutions for in‑depth analysis of the DNS traffic and anomaly detection. These include DNS filters, DNS gateways, or DNS firewalls. An example of such a solution is BI.ZONE Secure DNS.
DNS cache poisoning. Attackers spoof the IP address of a legitimate website with the address of an attacker‑controlled resource.
Accessing untrusted resources. These can be phishing websites that steal passwords and deploy malware on employees’ devices, or legitimate pages that a company sees as inappropriate (distract from work) such as public file sharing services, torrent trackers, gambling websites, etc.
DNS rebinding. This technique is often used to bypass defenses when penetrating a company’s local network.
Malware. Malicious commands can be passed inside the DNS traffic to hide an activity from network security solutions. The consequences depend on the program type: cryptojacking malware can overload the device while ransomware can completely halt a company’s operations. Related threats include:
- Data theft via DNS tunneling. This is one example of how a hidden channel is used to communicate with malware: sensitive data uploads from a private network to the Internet are disguised as DNS queries.
- Command and control (C2) servers
. Without the owners’ knowledge, infected devices are networked to perform DDoS attacks. - Domain generation algorithms (DGA). These are applied by cybercriminals to generate pseudorandom domain names and conceal the domain name of the C2 server.
DNS cache poisoning (DNS spoofing) enables adversaries to redirect user queries to malicious websites.
These attacks exploit system vulnerabilities in DNS servers to control traffic. For example, when entering www.example.com, the browser returns the IP address of www.1000virusov.ru. As a result, the victim is redirected to a malicious website where cybercriminals can steal private data, remotely monitor and send commands to the device.
DNS rebinding is another way to divert users to a forged resource instead of a legitimate one. This technique is used when scanning the infrastructure and gaining access to private servers. Here is how it works.
Let us assume there is a web application that can access third-party resources via HTTP protocol. The user types the required address into the search box, the application processes the query and opens the page.
Experienced web application developers commonly ensure protection against server-side request forgery (SSRF). This technique spoofs a public IP address with a private one to redirect a vulnerable application to the internal infrastructure for domain resolution. As a result, attackers can scan the LAN segment of a web application, collect information about available ports and hosts, operating systems in use, etc.
Most often, to defend against SSRF, the available subnets are closed on the backend of a web application. A query containing octets of the private IP address (e.g., 192.168.x.x, 10.10.x.x.x., etc.) is blocked and not executed.
This is exactly the mechanism targeted by DNS rebinding attacks. Malicious actors create a DNS A record (used to associate a domain with the server’s IP address) where they specify a forged IP address to return to the application. For example:
test.appdomain.com — 192.168.1.1
The web application sees test.appdomain.com in the search box and cannot detect octets of the local IP address, so the query is resolved. This is how adversaries using SSRF and DNS rebinding can gain unauthorized access to information about the local network environment.
DNS tunneling enables attackers to create a communication channel that bypasses most filters, firewalls, and antivirus software. DNS tunnels are therefore used to deliver and pass commands to malware, steal data from compromised networks.
Technically, this is possible because the DNS protocol allows users to add strings to a packet going from the client to the server or back. There are two ways to do this:
- Interaction with the C2 server over the DNS protocol occurs through specific queries added to the domain name.
- Illegitimate metrics are embedded in DNS packet headers which triggers the appropriate response from the server.
Public-facing solutions for securing DNS traffic build on a library of recommendations and international protocols. Some of them are:
- DNSSEC (DNS Security Extensions). A set of extensions to the primary DNS protocol for blocking DNS spoofing attacks. At each DNS level, data gets digitally signed. For example, when going to
bi.zone, the root DNS server signs the key for the.zoneserver, which in turn signs the key for thebi.zoneauthoritative server. If a compromised server gets into the chain at some point, it will not be able to infiltrate its queries into the traffic. - TSIG (transaction signature). A security protocol for identifying and verifying data integrity using asymmetric encryption. To confirm the legitimacy of the message, the client and server add the secure signature
to a special section of the DNS query. - DANE (DNS-based authentication of named entities). A method that authenticates certificates and digital signatures through the DNS system using DNSSEC.
Effective DNS protection combines static (signature) and dynamic filtering methods: the former search for threats based on accumulated knowledge bases, the latter track new signs of suspicious activity.
Static methods:
- verifying domains against black and white lists (including with RegEx)
- validating IP addresses by address spaces
- filtering queries to domains by more than 80 categories (e.g., “gambling” and “social networks”)
- filtering queries to phishing and malicious domains as well as to C2 servers based on data from the BI.ZONE Threat Intelligence portal
Dynamic methods:
- detecting and blocking DNS tunnels, including through statistical models
- DGA query filtering using machine learning algorithms
- supporting DNSSEC
- verifying responses from authoritative DNS servers, query randomization, and queries in different registers