What Is DNS Security and How Does It Work?

The Domain Name System (DNS) is often called the address book of the internet. It translates names people can remember, such as example.com, into the IP addresses that computers use to connect. Every time someone opens a website, sends an email, launches a cloud application or a server calls an API, a DNS lookup happens first, usually in a few milliseconds and without anyone noticing.

DNS was designed in 1983 by Paul Mockapetris to be fast, distributed and resilient. It was not designed to be secure. On the early internet every participant was trusted, so the protocol had no built-in way to prove that an answer was genuine, to hide what was being asked, or to stop a lookup that led somewhere dangerous. Attackers have been exploiting those gaps ever since, which is why DNS security is now a core part of any security programme.

What is DNS security?

DNS security is the set of practices and technologies that keep DNS trustworthy and use it to stop attacks. It has two sides that are easy to confuse:

• Protecting the DNS you depend on: making sure the answers for your own domains cannot be forged or hijacked, and that your DNS stays available under attack.
• Using DNS as a security control: checking every lookup your users and devices make, and refusing to resolve domains that lead to phishing, malware, command-and-control servers or data exfiltration. This second side is usually called protective DNS or DNS filtering.

How a DNS lookup works

To see where security fits, it helps to follow a single lookup from start to finish:

• A user types example.com. The device asks its configured recursive resolver for the address.
• The resolver checks its cache. If it already has a fresh answer, it replies immediately.
• If not, it asks a root server, which points it to the servers for the top-level domain (.com).
• The .com servers point it to the authoritative name servers for example.com.
• The authoritative servers return the actual record, such as the website's IP address.
• The resolver returns the answer to the device and caches it for as long as the record's time to live (TTL) allows.

Where security is added to each lookup

Modern DNS security adds protection at several points in that journey, and each layer solves a different problem:

• Encryption (DNS over HTTPS and DNS over TLS) protects the question and answer between the device and the resolver, so nobody on the network path can read or alter them.
• DNSSEC adds digital signatures to DNS records. A validating resolver checks the chain of signatures from the root down to the domain, so a forged answer is rejected.
• Protective DNS checks each requested domain against threat intelligence and the organisation's policy before answering. A malicious domain is blocked or redirected to a warning page, so the connection is never opened.
• Logging and analytics record which device asked for which domain, giving security teams one of the earliest signals of an infection.

Common threats to DNS security

Attackers abuse DNS both as a target and as a tool. The threats security teams meet most often are:

• Cache poisoning (spoofing): an attacker injects a forged record into a resolver's cache, sending users to a malicious server while the address bar still shows the real name.
• DNS hijacking: an attacker takes over a domain's registrar account or DNS records and points them at infrastructure they control.
• Phishing and look-alike domains: newly registered domains that imitate a brand, a login page or a supplier, often used within hours of registration.
• Command-and-control (C2): malware looks up its controller's domain to receive instructions. Domain generation algorithms (DGAs) create thousands of throwaway domains to stay ahead of blocklists.
• DNS tunnelling and exfiltration: data is encoded inside DNS queries and responses to slip past firewalls that allow DNS by default.
• Fast flux: a malicious domain rapidly rotates through many IP addresses, often compromised machines, so blocking by IP alone fails.
• DDoS and amplification: attackers flood DNS servers, or send small spoofed queries to open resolvers so that much larger responses hit a victim.

DNS security best practices

No single control covers every threat. A practical baseline for most organisations looks like this:

• Protect registrar and DNS-provider accounts with strong passwords, multi-factor authentication and registry lock where available.
• Sign your zones with DNSSEC and publish the DS record at your registrar.
• Send every user's and device's lookups through a protective DNS service, including laptops that work off the corporate network.
• Block malicious, newly registered and high-risk domain categories, using threat intelligence that is updated continuously.
• Control encrypted DNS: allow it to your approved resolver and block devices from bypassing it with public DNS over HTTPS services.
• Never run open resolvers, and keep DNS software patched and rate-limited.
• Send DNS logs to your SIEM and review unusual patterns such as high-entropy subdomains or repeated lookups of a single rare domain.

How DNS Armor™ approaches DNS security

DNS Armor™ covers both sides of DNS security on one platform. DNS Armor Protect™ answers your users' recursive queries and checks each one against your policy in about 4 ms: built-in threat feeds for malware, phishing, command-and-control and newly registered domains, machine-learning detection of DNS tunnelling and DGA domains, your own rulesets and any external RPZ feeds you subscribe to. A malicious lookup is blocked before a connection opens, for every application on the device, not just the browser.

Protect runs cloud-delivered from your assigned region, on-premises through the Local Resolver virtual appliance, and on roaming Windows, macOS and Linux devices through the Endpoint Agent. Query and block logs stream to the SIEM your security team already uses. For the domains you publish, DNS Armor Resolve™ provides authoritative DNS with automatic DNSSEC signing and key rollover, plus health-checked failover and geo steering.