Is a DNS SRV record lookup secure?

Question

I'm wondering how trustworthy the data from a SRV record lookup is? I have a program that essentially could fall apart if someone were to be able to spoof the SRV response.

If not, are there any precautions that could be taken to make it trustworthy?

Answer 1

The only reliable solution to spoofing seems to be using secure DNS servers for lookup. Currently the secure DNS lookup is provided by many DNS providers eg. cloudflare.

Answer 2

All DNS is completely insecure unless you're specifically using a secure DNS server with an encrypted protocol like DNSCrypt.

Even this may be insecure unless the server you're querying is the authoritative server for the requested resource. If it has to go off and ask another server, the link to the next server may or may not be secure.

Without encryption, everything can be modified and/or intercepted by an attacker like your ISP or anybody else along the way.

ISPs frequently intercept DNS queries in order to be "helpful", although they could just as easily be evil.

So the short answer to your question is "no". SRV lookups aren't secure and no other DNS queries are either.

If your application queries a DNS server you control, over a secure link, it should be fine. If you're just using whatever DNS your ISP provides, probably not.