Windows Server 2016 – DNS Server Security Features

I will write about 3 good security features in Windows Server 2016.

1. Response rate limiting

It is a good defense against denial-of-service attacks.

Set-DnsServerResponseRateLimiting -WindowInSec 6 -LeakRate 4 -TruncateRate 3 -ErrorsPerSec 8 -ResponsesPerSec 8
-WindowInSec Specifies the period (in seconds) over which rates are measured and averaged for RRL
-LeakRate Specifies the rate at which the server responds to dropped queries.
-TruncateRate Specifies the rate at which the server responds with truncated responses.
ErrorsPerSec Specifies the maximum number of times that the server can send an error response to a client within a one-second interval.
ResponsesPerSec Specifies the maximum number of times that the server sends a client the same response within a one-second interval.

, <span>Windows Server 2016 – DNS Server Security Features</span>, KandZ

Read more here.

2. DNS socket pool

It uses a random source port when issuing DNS queries. It is enabled by default. Use get-dnsServer to see the pool size.

, <span>Windows Server 2016 – DNS Server Security Features</span>, KandZ

If you want to increase/decrease the pool size use:

dnscmd /config /socketpoolsize 4000

, <span>Windows Server 2016 – DNS Server Security Features</span>, KandZ

Restart the DNS server

net stop dns
net start dns

, <span>Windows Server 2016 – DNS Server Security Features</span>, KandZ

, <span>Windows Server 2016 – DNS Server Security Features</span>, KandZ

3. Cache Locking

It controls when the DNS cache can be updated. -LockingPercent parameter from set-dnsservercache controls that.  By default, the cache locking percent value is 100. This means that the DNS server will not overwrite cached entries for the entire duration of the TTL.

set-dnsservercache -lockingPercent 90

, <span>Windows Server 2016 – DNS Server Security Features</span>, KandZ

More information here.

37500cookie-checkWindows Server 2016 – DNS Server Security FeaturesWindows Server 2016 – DNS Server Security Features

Related posts