Zone-Hopping: Sensitive Information Leakage Prevention for DNSSEC-NSEC

DNSSEC (DNS Security Extension) was developed to address significant security integrity flaws in DNS. We explore information leakage stemming from a known DNSSEC vulnerability that facilitates a process known as zone walking, which enables the efficient collection of all FQDNs. This paper is divided into two main sections. First, we show that the information leaked by zone walking is sometimes private and should be protected. We demonstrate this by identifying instances where private information is disclosed through zone-walking, emphasizing that zone walking is an effective replacement for network scanning in IPv6 networks, and that FQDNs often constitute de facto private information. This last point is addressed by comparing data collected from DomainTools’ passive DNS database with data collected from zone walking. We found that more than 50% of FQDNs found from zone walking are not in the passive DNS dataset. This indicates that these FQDNs are not used publicly, despite being accessible on publicly available DNS servers. In the second part of this paper, we propose and test a novel and practical approach - Zone-Hopping (ZH) to mitigate this information leakage issue, all the while preserving the integrity of the DNS/DNSSEC protocol. In some cases, ZH can be implemented through only small changes to a configuration file. Moreover, in contrast to other solutions, the proposal solution does not impose any extra computational load on authoritative DNS servers, and hence, does not open new avenues for DoS attacks.