DNS security options

Last published : Sep 24, 2026
You can now configure the DNS security options from the Add DNS Security Profile page in the NetScaler GUI. To configure the DNS security options from the NetScaler CLI or the NITRO API, use the AppExpert components. For instructions, see the NITRO API documentation and the NetScaler Command Reference Guide.
One option, cache poisoning protection, is enabled by default and cannot be disabled. You can apply the other options to all DNS endpoints or to specific DNS virtual servers in your deployment, as shown in the following table:
Security option Can be applied to all DNS endpoints? Can be applied to specific DNS virtual servers?
DNS DDoS protection Yes Yes
Manage exceptions – whitelist/blacklist servers Yes Yes
Prevent random subdomain attacks Yes Yes
Bypass the cache Yes No
Enforce DNS transactions over TCP Yes Yes
Provide root details in the DNS response Yes No
Enforce DNS transactions over TLS Yes Yes
Enforce DNS transactions over HTTPS Yes Yes
Related information

Cache poisoning protection

A cache poisoning attack redirects users from legitimate sites to malicious websites.
For example, the attacker replaces a genuine IP address in the DNS cache with a fake IP address that they control. When the server responds to requests from these IP addresses, the cache is poisoned. Subsequent requests for the addresses of the domain are redirected to the attacker’s site.
The Cache Poisoning Protection option prevents insertion of corrupt data into the database that caches DNS server requests and responses. This feature is inbuilt in the NetScaler appliances and is always enabled.

DNS DDoS protection

You can configure the DNS DDoS Protection option for each type of request that you suspect might be used in a DDoS attack. For each type, the appliance drops any requests received after a threshold value for the number of requests received in a specified time period (time slice) is exceeded. You can also configure this option to log a warning to the SYSLOG server. For example:
  • DROP: - Select this option to DROP requests without logging. Assume that you have enabled A record protection with threshold value 15, time slice as 1 second, and chosen DROP. When the incoming requests exceed 15 queries in 1 second, then the packets start getting dropped.
  • WARN: - Select this option to LOG and DROP requests. Assume that you have enabled A record protection with threshold value 15, time slice as 1 second, and chosen WARN. When the incoming requests exceed 15 queries in 1 second, a warning message is logged indicating a threat and then the packets are dropped. Citrix recommends you to set threshold values for WARN smaller than the threshold value of DROP for a record type. Such a setting helps administrators identify an attack by logging a warning message before the actual attack happens and NetScaler starts dropping incoming requests.

Set a threshold for incoming traffic by using the GUI

  1. Navigate to Configuration > Security > DNS Security.
  2. On the DNS Security Profile page, click Add.
  3. On the Add DNS Security Profile page, do the following:
  4. Expand DNS DDoS Protection.
    1. Select the record type and enter the threshold limit and the time slice value.
    2. Select DROP or WARN.
    3. Repeat steps a and b for each of the other record types that you want to protect against.
  5. Click Submit.

Manage exceptions – allowlist/blocklist servers

Manage exceptions enables you to add exceptions either to block list or allow list domain name and IP addresses. For example:
  • When a particular IP address is identified posting an attack, such IP address can be added to the block list.
  • When administrators find that there is an unexpectedly high number of requests for a particular domain name, then that domain name can be added to the block list.
  • NXDomains and some of the existent domains which can consume the server resources can be blacklisted.
  • When administrators allow list domain names or IP addresses, queries or requests only from these domains or IP addresses are answered and all others are dropped.

Create an allow list or a block list by using the GUI

  1. Navigate to Configuration > Security > DNS Security.
  2. On the DNS Security Profiles page, click Add.
  3. On the Add DNS Security Profile page, do the following:
    1. Expand Manage exceptions – Whitelist/Blacklist Servers.
    2. Select Block to block queries from blacklisted domains/addresses, or select Allow only to allow queries from whitelisted domains/addresses.
    3. In the Domain name / IP Address box, enter the domain names, IP addresses, or IP address ranges. Use commas to separate the entries. Note: If you select Advanced Option, you can use the "start with," "contains," and "ends with" options to set the criteria. For example, you can set criteria to block a DNS query that starts with "image" or ends with ".co.ru" or contains "mobile sites."
  4. Click Submit.

Prevent random subdomain attacks

In random subdomain attacks, queries are sent to random, nonexistent subdomains of legitimate domains. This action increases the load on the DNS resolvers and servers. As a result, they can become overloaded and slow down.
The Prevent Random Subdomain Attacks option directs the DNS responder to drop DNS queries that exceed a specified length.
Assume that example.com is a domain name owned by you and hence the resolution request comes to your DNS server. The attacker can append a random subdomain to example.com and send a request. Based on the specified query length and the FQDN, the random queries are dropped.
For example, if the query is www.image987trending.example.com, it is dropped if the query length is set to 20.

Specify a DNS query length by using the GUI

  1. Navigate to Configuration > Security > DNS Security.
  2. On the DNS Security Profiles page, click Add.
  3. On the Add DNS Security Profile page, do the following:
    1. Expand Prevent Random Subdomain Attacks.
    2. Enter the numerical value for the query length.
  4. Click Submit.

Bypassing the cache

During an attack, the data that is already cached must be protected. To protect the cache, new requests for certain domains or record types or response codes can be sent to the origin servers instead of cached.
The Bypassing the cache option directs the NetScaler appliance to bypass the cache for specified domains, record types, or response codes when an attack is detected.

Bypass the cache for specified domains or record types or response types by using the GUI

  1. Navigate to Configuration > Security > DNS Security.
  2. On the DNS Security Profiles page, click Add.
  3. On the Add DNS Security Profile page, expand Bypassing the cache and enter the domain names. Optionally, choose the record types or the response types for which the cache has to be bypassed.
    • Click Domains and enter the domain names. Use commas to separate the entries.
    • Click Record Types and choose the record types.
    • Click Response Types and choose the response type.
  4. Click Submit.

Enforce DNS transactions over TCP

Some DNS attacks can be prevented if the transactions are forced to use TCP instead of UDP. For example, during a bot attack, the client sends a flood of queries but cannot handle responses. If the use of TCP is enforced for these transactions, then the bots cannot understand the responses and therefore cannot send requests over TCP.

Force domains or record types to operate at the TCP level by using the GUI

  1. Navigate to Configuration > Security > DNS Security.
  2. On the DNS Security Profiles page, click Add.
  3. On the Add DNS Security Profile page, expand Enforce DNS Transactions over TCP and enter the domain names and / or choose the record types for which the DNS transactions must be enforced over TCP.
    • Click Domains and enter the domain names. Use commas to separate the entries.
    • Click Record Types and choose the record types.
  4. Click Submit.

Provide root details in the DNS response

In some attacks, the attacker sends a flood of queries for unrelated domains that are not configured or cached on the NetScaler appliance. If the dnsRootReferral parameter is ENABLED, it exposes all the root servers.
The Provide Root Details in the DNS Response option directs the NetScaler appliance to restrict access to root referrals for a query that is not configured or cached. The appliance sends a blank response.
The Provide Root Details in the DNS Response option can also mitigate or block amplification attacks. When the dnsRootReferral parameter is DISABLED, there are no root referrals in the NetScaler responses and hence they do not get amplified.

Enable or disable access to the root server by using the GUI

  1. Navigate to Configuration > Security > DNS Security.
  2. On the DNS Security Profiles page, click Add.
  3. On the Add DNS Security Profile page, do the following:
    1. Expand Provide Root Details in the DNS Response.
    2. Click ON or OFF to allow or restrict access to the root server.
  4. Click Submit.