A DNS server that responds to all requests indiscriminately, with open ports by default that no one has reviewed since commissioning: this pattern is found in the majority of corporate networks. Network security often hinges on these two neglected areas, DNS management and TCP port control, well before the purchase of a next-generation firewall.
Controlling DNS Resolvers: The First Lock to Place on the Network
On the ground, the problem almost always starts in the same place. Workstations and connected devices send their DNS requests to any resolver, including public resolvers that the administrator does not supervise. As long as the allowed resolvers are not restricted, an invisible outbound channel is left open.
The first action is to force all DNS traffic to a controlled internal resolver. Outgoing requests on UDP and TCP port 53 to any destination other than this resolver are blocked. This allows for logging each request, detecting suspicious domains, and cutting off communications to command and control (C2) servers.
DNS encryption complicates this approach. DNS over HTTPS (DoH) uses TCP port 443, the same as regular web traffic, making it difficult to filter with traditional network rules. DNS over TLS (DoT) goes through TCP port 853, which is more easily identifiable.
To maintain control, one can learn how Open Syd works and choose an appropriate strategy: allow DoT on port 853 to the internal resolver while blocking DoH on workstations to prevent browsers from circumventing the organization’s DNS policy.
Open TCP Ports: Audit Before Filtering
Servers are regularly seen with dozens of listening ports, some corresponding to services installed by default and never used. Each open port is a potential attack surface. The reflex is to scan one’s own perimeter before an attacker does.
An audit of active TCP and UDP ports, conducted from outside the network, often reveals forgotten services: an administration interface on a non-standard port, an exposed database service, an old mail server still reachable. Closing an unnecessary port reduces risk more effectively than a detection rule.
Prioritizing Closure by Risk Level
Not all open ports pose the same danger. Here is a pragmatic sorting approach:
- Ports related to remote administration (SSH on 22, RDP on 3389, web interfaces on 8080 or 8443) should be restricted to internal IP ranges or accessible only via VPN. Leaving them exposed on the Internet remains the primary cause of brute force compromise.
- Email service ports (25, 465, 587, 993) deserve strict geographical filtering if the activity is local, and a check that TLS encryption protocols are enabled to protect data in transit.
- Ports used by unencrypted protocols (Telnet on 23, FTP on 21, HTTP on 80) should be disabled in favor of their secure equivalents. If a legacy service requires their maintenance, that service should be isolated in a dedicated network segment.
DNS Logging and Correlation with TCP Flows
Blocking and filtering is not enough if one never looks at what is happening. Logging DNS requests, cross-referenced with connection logs on TCP ports, constitutes a formidable and underutilized detection tool.
A workstation that resolves an unusual domain name, then opens an outgoing TCP connection to an unknown IP address on a high port, produces a weak signal. Taken in isolation, each event seems harmless. It is the correlation between the DNS request and the TCP flow that reveals exfiltration.
The NIST SP 800-81 Revision 3 guide, published on March 19, 2026, emphasizes this notion of operational visibility. It groups DoH, DoT, and DoQ under the category “encrypted DNS” and recommends treating DNS not just as a simple background infrastructure, but as a full-fledged security control point.
What Logging Should Capture
To be useful, a DNS log must record at least the requested domain name, the source IP address, the timestamp, and the returned response. On the TCP port side, established, refused connections, and aborted connection attempts are retained. Returns vary on the ideal retention period, but the European Implementing Regulation 2024/2690, applicable since November 7, 2024, imposes on certain DNS and infrastructure service providers a continuous logging with proof of control effectiveness.
DNSSEC and Encryption: Protecting the Integrity of DNS Responses
A resolver that responds correctly does not guarantee that the response has not been altered along the way. DNS cache poisoning redirects users to fraudulent servers without triggering any alerts on the network side. DNSSEC adds a cryptographic signature to zone records to validate their authenticity.
DNSSEC validates the origin of responses, while DNS encryption protects their confidentiality in transit: the two mechanisms complement each other, neither replaces the other.
In practice, deploying DNSSEC on internal zones requires managing the renewal of cryptographic keys. An expired key without scheduled rotation causes a resolution failure as abrupt as an attack. One must automate the rotation or not deploy it at all.
Network Security Policy: Linking DNS and Ports in a Unified Approach
Treating DNS on one side and ports on the other creates blind spots. A service allowed by the firewall but resolving malicious domains will slip under the radar. Conversely, a DNS block without port control leaves the door open for direct connections by IP address.
The coherent approach links the three layers:
- The internal DNS resolver filters domains and logs requests.
- The firewall restricts TCP and UDP ports to only declared and maintained services.
- A correlation tool (SIEM or simple log analysis script) cross-references DNS events and network connections to identify abnormal behaviors.
This articulation does not require a significant budget. A filtering resolver, firewall rules revised quarterly, and a log stack reviewed weekly cover most vulnerabilities related to DNS and ports. The weakest link is not the tool, but the regularity of the review.
