DNS servers are now a primary attack vector of cyber criminals. Unfortunately, such attack has a wide impact as it affect all domains.

That’s why, securing DNS servers becomes very critical for any organization. Luckily, security features like DNSSEC help greatly to avoid attacks on DNS servers like Bind. And, to make it working we need to enable BIND EDNS.

At Bobcares, we receive requests from our customers to enable Bind EDNS as part of our Technical Support Services.

Today, we’ll see how Bobcares Engineers enable Bind EDNS and fix common errors with it.

Why EDNS?

Firstly, let’s see more details on EDNS and why we need it.

Extension mechanisms for DNS (EDNS) is simply expanding the size of several parameters of the Domain Name System (DNS) protocol. In original DNS, there are restrictions in the size of message size including flags, return codes, etc. Thus, DNS messages using UDP protocol can only carry messages of size 512 bytes. Therefore, it creates a major road block in adding new features in DNS.

Luckily, EDNS help to overcome this by adding a new type of record called OPT record.

In general, EDNS mechanism based on RFC 2671 first check if the receiving server supports EDNS feature. If both source and recipient servers support EDNS, they can exchange bigger packets of data. And, this solves the limitation of 512 bytes per dns message. Again, in such EDNS-aware DNS Server queries there exists the OPT record.

Usually, the dig command shows the OPT record. An example of an OPT pseudo-record looks as shown.

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096

EDNS is also used for sending general information from resolvers to name servers about clients’ geographic location too.

How to enable BIND EDNS?

Now, let’s see how our Dedicated Engineers enable BIND EDNS.

To define whether to use EDNS with a specific server or not, we edit the BIND configuration file at /etc/named.conf.

For example in a Linux server, we set it in the server clause available in BIND 9.x named.conf as:

edns yes;

The default value will be set as “yes”, unless EDNS is specifically turned off. Additionally, BIND supports variables like edns-udp-size, max-udp-size, etc.  Both these values support integer values and we set it according to the customer requirement.

Similarly, to enable EDNS on Windows Server 2008 R2, we simply type

dnscmd /config /enableednsprobes 1

This enables EDNS on the server and works without a server reboot too.

Common errors and fixes

Although enabling BIND EDNS looks pretty easy, we often see users experiencing problems with the EDNS option.

Let’s take a look at the typical problems and how our Dedicated Engineers fix it.

1. Missing EDNS support

Recently, one of our customers came to us asking for the reason for EDNS related errors in the BIND logs. This customer was already running BIND server with EDNS  enabled. When he tried to query a website, it showed the error:

13-Dec-2018 08:05:34.970 dnssec: debug 4: validator @0x7fxxxx20: dns_validator_destroy
13-Dec-2018 08:05:34.970 edns-disabled: info: success resolving 'www.abc.domain.com/A' (in 'abc.domain.com'?) after disabling EDNS

Here, this error means that the remote name server doesn’t correctly support EDNS query from the server. Therefore,  BIND failed-over to “plain” DNS instead of EDNS.

So, in this case our Support Engineers educated the customer that the settings were correct at our side. Additionally, we had to contact the remote nameserver provider and change the settings at their end.

2. Firewall Settings and EDNS

Similarly, BIND EDNS can report problems when firewall between the bind server and the Internet drops DNS messages > 512 bytes.

In such a case, it will show the following errors in log file.

Jan 31 15:15:25 srvx named[12914]: success resolving 'xyx.domain.com/AAAA' (in 'domain.com'?) after reducing the advertised EDNS UDP packet size to 512 octets

As per the latest security norms, firewalls must not drop DNS packets with EDNS extensions, including unknown extensions

Here, to fix the problem, our Dedicated Engineers had to work with Internet Service Provider to upgrade the firewall so that it is EDNS compatible and allows DNS messages > 512 bytes.

Again, when the option to change firewall do not work, we temporarily fix the problem by disabling EDNS within bind. However, we re-enable EDNS once the problem with firewall is solved.

[Have trouble with enabling BIND EDNS ? Our experts can enable it for you.]

Conclusion

For making server DNSSEC compatible, it is mandatory to enable BIND EDNS on the server. Today, we saw how our Support Engineers enable EDNS and fix common errors with it.