DNS Router or not?

[anotherengineer]

So after running the DNS Bench, in the conclusions it says.....

" System has only ONE (router based) nameserver configured.

It appears that only one local (router gateway) DNS nameserver, with the IP address of [192.168.x.x], is currently providing all DNS name resolution services to this system. This configuration is not recommended because most consumer-grade routers provide inefficient and under-powered DNS resolution services.

Unless the DNS resolvers your router is using is under your control, it may not be providing the best or complete name resolution services. For example, is it using multiple redundant DNS nameservers?

Users of GRC's DNS Spoofability system have determined that consumer-grade routers can be crashed by the receipt of specific DNS reply packets from the Internet. This opens the possibility that Internet-based criminals could acquire access to your router from the Internet as well as to the private network in controls.

Many consumer-grade routers fail to provide the full range of DNS lookup services. This may have been detected by the benchmark and noted below.

Recommended Actions:

Unless you have some specific reason not to, you should give serious thought to disabling your router's provisioning of DNS services (which it is providing for all computers on your local network). After this is done, a fresh reboot of your computers will likely reveal the multiple DNS nameservers provided by your ISP. This is a superior configuration, without an under-powered router acting as a incompetent middleman and impeding all DNS access.

Note that if you can determine the IP addresses of your ISP-provided nameservers (which may be visible in your router's web configuration) you could manually add them to the nameservers being tested by this benchmark, while also leaving your router providing DNS. This would allow you to compare the performance when running through your router versus "going direct".


I have a Asus RT-N66U on Merlin 380.58, and I have my DNS in there.

So is the DNS Bench conclusion "more correct" ??

Thanks

 

[L&LD]

In a word, no.

 

[anotherengineer]

In a word, no.

So basically keep the DNS set on my router then and carry on?

 

[ColinTaylor]

Yes.

 

[sfx2000]

So after running the DNS Bench, in the conclusions it says.....

" System has only ONE (router based) nameserver configured.

Many router/AP's will configure clients over DHCP as a single DNS server... it's per design, as they can use DNSMasq to act as a cacheing DNS server for the network.

To do a proper test with DNS bench, you need to configure the DNS entries on the client directly, overriding the DHCP assigned DNS (which in most cases is the dnsmasq daemon in the Router/AP box)

 

[sfx2000]

Users of GRC's DNS Spoofability system have determined that consumer-grade routers can be crashed by the receipt of specific DNS reply packets from the Internet. This opens the possibility that Internet-based criminals could acquire access to your router from the Internet as well as to the private network in controls.

Many consumer-grade routers fail to provide the full range of DNS lookup services. This may have been detected by the benchmark and noted below.

This is a predictable outcome of several security weaknesses in Consumer-Grade router AP's - whether it's remote acccess vuln, or cross-site vulns within the WebUI, it is possible for micreants to add/poison the DNS on the router/AP - it's one of the reasons why I don't recommend Consumer-grade Router/AP's in a business environment - security/stability are a priority there...

Some of the vendors are better than others, but why take the risk in the first place?

 

[System Error Message]

some consumer routers have minimal dns configuration and hardware. The firmware on the asus router can be changed such as via command line to configure dns service on the router itself. as a DNS server it has plenty hardware and as long as you can put aside a few MB it is sufficient for a few to few hundred clients.