Reducing What DNS and Passive DNS Reveal About You (T1596.001)

DNS/Passive DNS (T1596.001) is a reconnaissance sub-technique of Search Open Technical Databases. Its platform is PRE. The adversary looks at DNS data about your organization and uses it to plan.

DNS is public by design. Anyone who wants to reach your website or send you mail has to be able to ask where things are. The risk comes from how much those answers say.

How attackers use it

MITRE says DNS information may include registered name servers and records that outline addressing for a target's subdomains, mail servers and other hosts.

There are two ways to get it. Threat actors can query nameservers for a target organization directly. Or they can search centralized repositories of logged DNS query responses, known as passive DNS. MITRE also says adversaries may look for DNS misconfigurations or leaks that reveal information about internal networks.

The output feeds other steps: further reconnaissance such as Search Victim-Owned Websites, acquiring or compromising infrastructure, and initial access through External Remote Services or Trusted Relationship.

Passive DNS is worth dwelling on. Even if you delete a record today, a repository that logged past responses may still hold it. Old hostnames can outlive the systems they pointed at.

How to detect it

MITRE notes that much of this activity occurs at high volume with a high false positive rate, and may take place outside your visibility, so detection is difficult. Focus on related stages, such as Initial Access.

Nameserver query logs might show unusual lookups of many subdomain names from one source, which can hint at guessing. Treat it as a hint, not proof.

How to reduce the risk

MITRE's mitigation is Pre-compromise: the activity is outside your defenses, so the goal is to minimize the amount and sensitivity of data available to external parties.

For DNS, that means:

• Keep internal names out of public DNS. Use split-horizon or private zones for internal hosts.
• Remove records for decommissioned services, and make sure removed names do not still point at resources you no longer control.
• Check zone configuration so it does not leak more than intended.
• Do not put sensitive details in record names or TXT values.

Check your own environment

List the common records for your domain (any OS with dig):

dig +short A your-domain.example
dig +short MX your-domain.example
dig +short TXT your-domain.example

Then review:

• Does every public hostname belong to a system someone still maintains?
• Do any public names expose internal naming or project names?
• Does anything in TXT records reveal vendors you would rather not advertise?

Quick check

Sources

• MITRE ATT&CK, DNS/Passive DNS (T1596.001)