DNS Security

DNS security encompasses both the protection of DNS infrastructure itself and the use of DNS data as a threat detection layer. On the protective side, DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records to prevent tampering and cache poisoning. DNS filtering blocks resolution of known-malicious domains at the resolver level, preventing connections before they reach the endpoint. On the authentication side, SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) use DNS TXT records to authenticate email senders and instruct receivers how to handle authentication failures.

DNS is one of the most abused protocols in attacker toolkits. It is used for C2 communication via DNS tunneling, domain generation algorithms (DGAs), fast-flux infrastructure to evade blocklists, and lookalike domain registration for phishing. Simultaneously, misconfigured SPF, DKIM, and DMARC records are a leading enabler of business email compromise (BEC) and phishing — attackers spoof legitimate domains precisely because email authentication is absent or misconfigured. DNS-layer visibility gives defenders a high-fidelity, low-noise detection plane: malicious DNS queries are often the earliest observable signal in an attack chain.

DNSSEC works by having zone operators sign DNS records with a private key; resolvers validate signatures using a published public key, forming a chain of trust from the root zone down. DNS filtering operates at the recursive resolver level — queries for blocked domains return NXDOMAIN or a sinkhole IP rather than the real answer, preventing connection. SPF publishes authorized sending IP ranges in a DNS TXT record; receiving mail servers check whether the sending IP is listed. DKIM attaches a cryptographic signature to email headers; receivers fetch the public key from DNS to validate the signature. DMARC builds on SPF and DKIM, specifying policy (none, quarantine, reject) for messages that fail authentication and providing aggregate reporting back to the domain owner.