• Glossary
  • What is ACL (access control list)?

Security glossary

What is ACL (access control list)?

An ACL (access control list) is a security control that permits or denies access to a resource based on defined criteria such as source address. It is evaluated rule by rule, and in DNS servers it restricts who can send queries, request zone transfers, or submit dynamic updates.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

An ACL (access control list) is a security control that permits or denies access to resources such as DNS queries, zone transfers, and dynamic updates based on defined criteria like source IP address, evaluated rule by rule in order of appearance. In DNS environments, ACLs are critical for restricting unauthorized zone transfers that expose network topology, preventing abuse of recursive resolvers in amplification attacks, and controlling who can submit dynamic updates, though they must be combined with authentication methods like TSIG to resist source address spoofing. Poorly managed ACLs fail at scale as exceptions accumulate, stale entries expose decommissioned addresses to reuse by unrelated hosts, and rule ordering mistakes or missing implicit deny awareness can create outages or leave services overly exposed to the internet.

  • DNS authoritative servers that permit zone transfers to any requester expose complete zone contents, giving attackers a map of hosts and services in the network.
  • ACL entries must be evaluated in strict top-to-bottom order because a broad permit rule placed above a specific deny rule renders the deny ineffective and allows unwanted traffic through.
  • Address-based ACL matching alone is vulnerable to source IP spoofing, especially over UDP, so sensitive operations like dynamic updates require additional authentication such as TSIG with shared secret keys.

ACL at a glance

AttributeValue
Full nameAccess control list
CategorySecurity control
Primary usePermitting or denying access to a resource based on defined match criteria
Related termsFirewall, Zone transfer, Dynamic DNS update, TSIG, Recursive resolver, Split-horizon DNS

How ACL works

An ACL is a list of entries, each pairing match criteria with an action of permit or deny. The system that enforces the list compares a request against the entries and applies the result of the first match.

  1. Request arrives: A client or device attempts an action, such as sending a DNS query, requesting a zone transfer, or forwarding a packet through a router.
  2. Criteria extracted: The enforcing system reads the attributes the list uses for matching, commonly the source IP address, and on network devices also the destination, protocol, or port. DNS servers can also match on a cryptographic key.
  3. Entries evaluated in order: The system checks entries from top to bottom. Most implementations stop at the first entry that matches and apply its action.
  4. Action applied: A permit entry lets the request proceed. A deny entry rejects or drops it. Many systems end the list with an implicit deny, so a request that matches nothing is refused.

Because order matters, a broad permit placed above a narrow deny can make the deny ineffective. In DNS servers, separate lists commonly govern different functions, such as queries, recursion, transfers, and updates, so each function can have its own audience. Address-based matching can be spoofed, so sensitive operations like dynamic updates are better protected by also requiring authentication such as TSIG.

Why ACL matters in enterprise networks

Access control lists are one of the most widely used controls in networking because they are simple and available on nearly every router, firewall, and DNS server. The cost appears at scale. Lists grow as exceptions accumulate, and engineers lose track of why an entry exists. Stale entries that reference decommissioned addresses can later be reused by unrelated hosts and inherit access they should never have had.

For DNS, ACLs have a clear security role. An authoritative server that allows zone transfers to any requester exposes its full zone contents, which gives an attacker a map of hosts and services. A recursive resolver that answers queries from any source can be abused in reflection and amplification attacks, which is why guidance such as BCP 140 on preventing use of recursive nameservers in reflector attacks recommends limiting recursion to intended clients.

Poorly managed ACLs fail in two directions. Overly permissive rules leave services open to the internet, while overly strict or misordered rules block legitimate clients, producing intermittent resolution failures that are hard to trace. Keeping lists documented, reviewed, and consistent across servers reduces both outcomes, and combining address matching with authentication limits the damage from spoofed sources.

ACL vs Firewall

An ACL is a rule list that permits or denies traffic or requests, while a firewall is a device or service that enforces policy and may use ACLs along with other inspection methods.

AttributeACLFirewall
What it isAn ordered list of permit and deny entriesA device or software service that enforces security policy
Typical matchingSource address, and on network devices destination, protocol, or portAddresses and ports, and often connection state or application
State trackingOften stateless on routers and switchesCommonly stateful
Where it runsRouters, switches, firewalls, DNS serversNetwork perimeters, host systems, or virtual appliances

ACL vs TSIG (Transaction Signature)

An ACL decides who is allowed based on match criteria such as an address, while TSIG authenticates a DNS message with a shared secret key. What is TSIG?

AttributeACLTSIG (Transaction Signature)
PurposePermits or denies requestsAuthenticates DNS transactions
Basis of trustMatch criteria such as source IP addressShared secret key and a signature on each message
Spoofing resistanceWeak when it relies on source address aloneStronger, because forging a message requires the key
Common DNS useLimiting queries, zone transfers, and updatesSecuring zone transfers and dynamic updates

Common ACL issues

A broad permit placed above a specific deny means the deny never matches, so traffic that should be blocked gets through. Engineers usually find this after a hit counter on the deny entry stays at zero.

Many implementations end a list with an unwritten deny, so adding a first entry to a previously empty list can suddenly block everything else. This often causes an outage right after a small change.

Entries naming decommissioned hosts remain in place after the address is reassigned. The new host then inherits access, such as zone transfer permission, that nobody intended to give it.

An ACL that relies only on source IP can be bypassed by forged packets, especially over UDP. Pairing it with key-based authentication or network-edge filtering reduces the exposure.

Allowing queries from any address on a recursive server makes it usable for amplification attacks. Allowing transfers to any address exposes the full zone contents.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

ACL FAQ

Related terms

Article

Transaction Signature (TSIG)

A protocol that enables DNS to authenticate updates to a DNS database; most commonly used to update dynamic DNS or a secondary DNS server.

Learn more
Article

Authoritative DNS server / Authoritative name server

Provides original and definitive answers to DNS queries.

Learn more
Article

Recursive DNS server

Responsible for providing the proper IP address of the intended domain name to the requesting host; the first servers contacted as the result of a request.

Learn more
Article

DMZ (Demilitarized zone)

A subnetwork that contains and exposes an organization’s external-facing services to an untrusted, usually larger, network such as the internet.

Learn more
Article

DNS zone

A distinct, contiguous portion of the domain name space for which administrative responsibility has been delegated to a single manager.

Learn more
Article

Transport layer security (TLS)

A cryptographic protocol to provide communications security over a computer network.

Learn more
Article

Remote Authentication Dial-In User Service (RADIUS)

A client/server protocol and software that enables remote access servers to communicate with a central server to authenticate dial-in users and authorize their access to the requested system or service.

Learn more
Article

AAA (Authentication, Authorization and Accounting)

Refers to a family of protocols that mediate network access.

Learn more
Browse the full glossary