Abstract: Systems, methods, and software described herein manage server connection resets based on domain name server (DNS) information. In one implementation, a firewall may receive a reverse DNS request from a computing system and communicate a request to a DNS security service to determine whether a destination associated with the reverse DNS request is malicious. The firewall further receives a response from the DNS security service that indicates that the destination is malicious and, when the response indicates that the destination is malicious, communicates a reset command to the destination to reset a connection between the destination and the computing system.

Abstract: The technology disclosed herein enables detection of domain hijacking when a DNS resolver is performing a DNS lookup. In a particular embodiment, a method provides receiving a DNS request from a requesting computing system. The DNS request includes a domain name for which the requesting computing system is requesting resolution of a network address associated with the domain name in the DNS. The method further provides, in response to receiving the DNS request, identifying a nameserver, via a root nameserver of the DNS, to handle the DNS request and determining the nameserver is not a proper nameserver for the domain name specifically. The proper nameserver is defined by nameserver criteria generated specifically for the domain name. The method also provides preventing the nameserver from being used to resolve the DNS request in response to determining that the nameserver is not a proper nameserver for the domain name.

Abstract: Systems, methods, and software described herein manage server connection resets based on domain name server (DNS) information. In one implementation, a firewall may receive a reverse DNS request from a computing system and communicate a request to a DNS security service to determine whether a destination associated with the reverse DNS request is malicious. The firewall further receives a response from the DNS security service that indicates that the destination is malicious and, when the response indicates that the destination is malicious, communicates a reset command to the destination to reset a connection between the destination and the computing system.

Abstract: The technology disclosed herein enables detection of domain hijacking when a DNS resolver is performing a DNS lookup. In a particular embodiment, a method provides, in response to a request to resolve a network address corresponding to a domain name, determining that a nameserver for the domain name is suspect based on satisfaction of nameserver criteria associated with the domain name. The method further includes preventing the nameserver from being used to resolve the request in response to determining that the nameserver is suspect.

Abstract: Systems, methods, and software described herein manage server connection resets based on domain name server (DNS) information. In one implementation, a firewall may receive a reverse DNS request from a computing system and communicate a request to a DNS security service to determine whether a destination associated with the reverse DNS request is malicious. The firewall further receives a response from the DNS security service that indicates that the destination is malicious and, when the response indicates that the destination is malicious, communicates a reset command to the destination to reset a connection between the destination and the computing system.

Abstract: The technology disclosed herein enables detection of domain hijacking when a DNS resolver is performing a DNS lookup. In a particular embodiment, a method provides, in response to a request to resolve a network address corresponding to a domain name, determining that a nameserver for the domain name is suspect based on satisfaction of nameserver criteria associated with the domain name. The method further includes preventing the nameserver from being used to resolve the request in response to determining that the nameserver is suspect.