2

The Allow DNS Suffix Appending to Unqualified Multi-Label Name Queries group policy was introduced in Windows Vista, and blocks the behaviour of child subdomains being tested against domain suffix, for example:

ping example will check example, but also example.mydnssuffix.local, however ping example.tld will check example.tld, but not example.tld.mydnssuffix.local.

Because this is disabled by default, I assume there are security implications involved in enabling this. Does anyone know what those security implications would be?

HopelessN00b
  • 54,273
Steven Blom
  • 23

1 Answers1

4

DNS clients that spend more time appending suffixes to ambiguous names and retrying their searches will take longer before giving up. This can cause significant slowdowns in applications that perform a lot of DNS queries.

It can also create a security concern if DNS clients erroneously resolve a name that is under the control of an external, malicious entity. Appending DNS suffixes is basically the opposite of devolution, which can present similar concerns. I'll copy the example from the Windows IT Pro website (which is primarily about devolution, but also applies somewhat to appending suffixes) :

A domain-joined computer's primary domain suffix is mycompany.fl.us (mycompany is located in Florida, hence the extension fl.us) and tries to connect to mailserver1. In this example, the DNS client will try to resolve mailserver1.mycompany.fl.us and mailserver1.fl.us. The last name in this list, mailserver1.fl.us, is outside of the control of my company. If a malicious person has registered mailserver1.fl.us in the DNS, the name resolution will succeed, the domain-joined computer will try to connect to it, and the malicious user could spoof an internal server.

So why would you want to turn it on? You might want to give DNS clients the added flexibility of hopefully being able to resolve ambiguous names. But it could theoretically lead to a security concern. So it's up to the administrator to decide what is more appropriate for his or her environment.

Further reading:

http://blogs.technet.com/b/networking/archive/2009/04/16/dns-client-name-resolution-behavior-in-windows-vista-vs-windows-xp.aspx

And:

http://windowsitpro.com/networking/whats-dns-name-devolution

Ryan Ries
  • 56,311