Note: This is the second post in a series about the revision of NIST Special Publication (SP) 800-81: Secure Domain Name System (DNS) Deployment Guide.

In revising NIST SP 800-81, I am going through it section by section and seeing what parts need to be revised.  This is in addition to an entirely new section with recommendations on recursive servers and validators.

Looking at Sections 1-5, there seems to be relatively little that needs changing, but let’s break it down by section:

Section 1 Introduction: Besides minor updates, bring it into conformance with the newly added section(s), not much to do here.

Section 2 Securing Domain Name System: Most of this section provides background on the DNS and breaks down the various components.  Again, since there haven’t been any radical changes to the DNS protocol itself, there aren’t any significant changes.  Maybe some additional text in this section about new gTLDs?  Other than more information, it will not add anything significant.

Section 3 DNS Data and DNS Software: This section describes the basic roles (authoritative and caching severs).  Should a subsection on validators be included?  Are validators different enough to include it as a separate subsection or just include some discussion in the subsection covering resolvers?

Section 4 DNS Transactions: and message types (query, dynamic update, NOTIFY, etc.). This section describes the basic transactions in DNS (i.e., query/response, etc.). Since there hasn’t been a new DNS transaction type defined since the first version of this publication, no apparent edits are needed here.

Section 5 DNS Hosting Environment – Threats, Security Objectives and Protection Approaches:  This section details some threats to the host systems used in DNS (i.e., servers, resolvers). Most of the section is still relevant, but might need some updating to the sub-section on resolvers to address validation. The discussion is high-level, so trends like virtualization do not need to be discussed, but may be included if there are valid concerns.

As before, comments and/or opinions on the questions above, post them below.  They will be considered as the SP 800-81 revision process continues.

The views presented here are those of the author and do not necessarily represent the views or policies of NIST.