DNS security

What it means

DNS, the Domain Name System, is the lookup service that turns a name like example.com into the address of a server. DNS security is the set of controls that keep those answers correct, and that stop other people from changing your records.

DNS was designed in a more trusting age, and answers are not checked by default. If someone can alter a record, or trick a resolver into storing a false answer, your users can be sent to a server you do not control.

Why it matters

Whoever controls your DNS controls where your traffic goes, and where your email goes. A changed record can send customers to a fake login page, redirect mail to the attacker, or let someone obtain a valid TLS certificate for your domain. Few other failures are so complete.

It is often neglected because it works quietly. Old records for services you shut down can be claimed by others, which is subdomain takeover. An unlocked domain account with a weak password can lose you the name itself. Check the account protecting your domain as carefully as any production system.

How it shows up

The main controls are strong access to the registrar and DNS provider accounts with multi-factor authentication, a registrar lock, and regular review of records. DNSSEC adds digital signatures so resolvers can check that an answer is genuine, as described in RFC 4033. Encrypted lookups such as DNS over HTTPS protect users' queries from eavesdroppers.

Typical mistakes: dangling records that point at deleted cloud resources (see dangling DNS), too many people with edit rights, no alert when a record changes, and email records such as SPF and DMARC left incomplete. Keep an inventory of what each record is for.