Private IP address in public DNS

Some people will say no public DNS records should ever disclose private IP addresses….with the thinking being that you are giving potential attackers a leg up on some information that might be required to exploit private systems.

Personally, I think that obfuscation is a poor form of security, especially when we are talking about IP addresses because in general they are easy to guess anyway, so I don’t see this as a realistic security compromise.

The bigger consideration here is making sure your public users don’t pickup this DNS record as part of the normal public services of your hosted application. ie: External DNS lookups somehow start resolving to an address they can’t get to.

Aside from that, I see no fundamental reason why putting private address A records into the public space is a problem….especially when you have no alternate DNS server to host them on.

If you do decide to put this record into the public DNS space, you might consider creating a separate zone on the same server to hold all the “private” records. This will make it clearer that they are intended to be private….however for just one A record, I probably wouldn’t bother.

Leave a Comment