There have been multiple posts about the IPS alarms for suspicious DNS queries, especially alarms that occur when a lookup is attempted on a free-registration domain like .TK or .ML
The logic of DNS blacklisting makes sense: It is easier to block a DNS name or name prefix, than it to block all possible IP addresses and ports that may be referenced if the DNS lookup succeeds.
UTM IPS has options for ALERT or DROP. Alert does nothing to prevent the threat from detonating, so the instinctive decision is to configure it to Block. But blocking a DNS query is very different from blocking other traffic. Anytime IPS blocks a packet, the initiator experiences a timeout condition. For normal traffic, this causes the client to conclude that the target machine is not working. For a DNS query, silence will cause the initiator to conclude that the DNS server is down, rather than concluding that the target system is down.
When a client concludes that a DNS server is down, the usual behavior is to change to a secondary DNS server and try again. This query may also be blocked. So the net result is to increase unnecessary network traffic, and to move DNS queries from a most-preferred server to a less-preferred server. The less-preferred server may have lower performance, so overall network performance may be hindered. I can imagine a situation where a client exhausts all of its DNS options, and quits trying to resolve any DNS name, although I have not seen this occur. Whether it can occur or not is probably dependent on the rate of failed lookups and the implementation details of your DNS clients.
What is needed is for the client to get a negative result (unknown DNS name), so that it stops trying to reach that server, rather than a result which incorrectly suggests a DNS problem. The Quad9.org service purports to do this, although I have not used it yet. Norton DNS uses a different approach - it returns a Norton honeypot IP address for blacklisted DNS lookups. Web traffic port 80 receives a Norton block message, while all other ports are unresponsive.
Until and unless UTM DNS can behave like Quad9 or Norton, I think it is wise to set the IPS rules for Miscellaneous Servers... DNS to either Alert or Disabled, and risky to choose Block.
This thread was automatically locked due to age.
