SafeDNS
Information Systems & Computing operates a central Domain Name System (DNS) firewall service, called SafeDNS. This service performs conventional DNS resolver functions—translating human-readable hostnames to IP addresses on behalf of client computers—but when asked to resolve the name of a server that is known to host malicious content, it responds instead with the address of a safe server on campus.
It has become increasingly difficult to protect client workstations from becoming compromised by malicious software. Even if workstations are patched and running up-to-date anti-virus software, some risks remain because of the:
- Increasing prevalence of 0-day threats (attacks that exploit vulnerabilities for which there is no patch);
- Incomplete effectiveness of anti-virus software in detecting polymorphic malware; and
- The prevalence of malicious third-party ads hosted on otherwise legitimate web sites.
This is the problem SafeDNS aims to solve.
An ordinary DNS resolver performs recursive name resolution of network name to network address on behalf of its clients, caching the responses to improve performance for subsequent queries for the same names. An ordinary firewall examines packets in transit, and selectively blocks ("discards") those that match rules defining undesirable traffic. A DNS firewall examines only the responses to DNS queries, not all packets, and instead of blocking those that are deemed undesirable, replaces them with known-safe responses.
The SafeDNS service at Penn is built using the same high performance, high availability resolver architecture as our standard resolvers: the service is distributed across physical servers in multiple, distinct data centers across the Penn campus, and uses anycast routing to enable maintenance and failure recovery that are transparent to end users.