DNS Security checks for records different than A

TomaszSobczak — Fri, 08 Sep 2023 06:20:13 GMT

Hi,

Does DNS Security checks DNS records other than A and how it works ? I think CNAME are checked as they are similar to A in meaning of request content. How about other records like PTR and TXT as they can be used more frequently for C2 traffic?

Re: DNS Security checks for records different than A

BPry — Tue, 12 Sep 2023 03:45:46 GMT

@TomaszSobczak,

I'd open a ticket with your SE and ask them to verify with someone on the product team, but I don't see any reason why CNAME, TXT, and PTR wouldn't also fall under DNS Security. You're still doing a DNS record lookup, you're just looking at a different type of record; you should still be getting the proper category.

I know that CNAME cloaking as an example will get a domain registered as adtracking when PAN identifies the traffic from a categorization aspect.

topic DNS Security checks for records different than A in General Topics

DNS Security checks for records different than A

Re: DNS Security checks for records different than A