In short
DNS security is the practice of protecting the Domain Name System, and the people who rely on it, from abuse. In practice it means sending lookups to a protective resolver that checks each domain against threat intelligence and policy and refuses to resolve phishing, malware and command-and-control domains, plus securing your own domains against hijacking and tampering.
Want help with DNS security?
We can plan it with you or do it for you. Tell us where you are up to.
DNS: the internet's address book
Computers connect to IP addresses; people and software use names. The Domain Name System (DNS) translates one into the other. When you type a web address, click a link in an email, or an app checks for updates, the device first asks DNS: "what is the address for this name?"
A typical lookup goes like this:
- The device's built-in stub resolver sends the question to the DNS server it has been given, usually by your router, your internal DNS servers or a VPN.
- That recursive resolver checks its cache. If it already knows the answer, it replies at once.
- If not, it works down the hierarchy: a root server points it to the servers for the top-level domain (such as .uk), which point it to the domain's authoritative servers.
- The authoritative server returns the answer, the resolver caches it for the time the record allows (its TTL), and the device connects.
The recursive resolver is the interesting part for security. Whoever runs it sees every name your devices look up, and decides what answer comes back. Change the resolver and you change what devices can reach.
Why DNS is a security risk
DNS was designed in the 1980s for a small, trusted network; the core standards (RFC 1034 and RFC 1035) date from 1987. Security was not a design goal, and several features that make DNS simple also make it easy to abuse:
- Lookups are traditionally unencrypted, so anyone on the path can read them, and a device will accept an answer without proof that it is genuine unless DNSSEC is used.
- Outbound DNS is allowed almost everywhere, because nothing works without it. That makes it an attractive channel for malware to contact its controller or smuggle data out.
- New domains are cheap and quick to register, so attackers can spin up lookalike and throwaway domains for phishing and malware faster than block lists built by hand can follow.
- Your own domains depend on accounts and records at registrars and DNS hosts. If someone takes over those accounts, they can redirect your website or email.
So when people ask "what is DNS in cyber security?", the answer has two sides: DNS is a channel attackers use (phishing links, malware downloads, command and control, DNS tunnelling) and a target they attack (DNS hijacking and DNS spoofing). DNS security deals with both.
How DNS protection works
The main control is a protective DNS resolver: a recursive resolver that refuses to resolve known-bad domains. You point your networks at it, and install a small agent on devices that leave the office. For each lookup it:
- Checks the domain against deny lists fed by threat intelligence, and against the content categories your policy blocks. The NCSC notes that many services also check the IP address in the answer.
- Checks your allow list, so business-critical domains keep working even if they are flagged.
- Answers normally if the domain is safe, or returns a block response if it is not: a block page, a DNS sinkhole address or an NXDOMAIN ("no such domain") reply.
- Logs the decision, so you can see which device or user tried to reach what, and spot devices that keep contacting malicious domains.
The NCSC's guidance on protective DNS sets out what a good service should offer, from threat-intelligence-fed deny lists to roaming clients and controls that stop users bypassing it. Generic content blocking by category is often called DNS filtering; our sister site covers that in depth.
DNS security also covers the domains you own: signing them with DNSSEC, locking them at the registrar and protecting the accounts that manage them with multi-factor authentication.
What DNS security blocks
| Threat | What it looks like | How DNS security helps |
|---|---|---|
| Phishing | A link to a fake Microsoft 365 or bank login page | The lookup for the phishing domain is refused, so the page does not load |
| Malware delivery | A download from a compromised or malicious site | The hosting domain is blocked before the file is fetched |
| Command and control (C2) | An infected device contacting its controller, sometimes via generated (DGA) domains | Known C2 domains are blocked and the attempts appear in logs |
| DNS tunnelling and exfiltration | Data encoded in long, random-looking subdomains | Services with query analytics can detect and block the pattern |
| Newly registered domains | A domain registered hours before a phishing campaign | An optional category blocks domains with no reputation yet |
| Unwanted content | Adult, gambling or other sites your policy does not allow | Content categories are blocked per group, with SafeSearch on supported services |
Because the check happens at the lookup, it covers every application that uses your resolver: browsers, email clients, chat apps, background services and malware itself. See DNS attacks for each threat in more detail.
Not sure which option applies to you? Ask us
Tell us about your organisation and we will point you to the right option.
What DNS security cannot see
DNS security is a strong first layer, not the whole stack. Be clear about its limits:
- Pages and paths on allowed domains. DNS sees example.com, not example.com/bad-page. A malicious file on a popular file-sharing domain resolves like everything else.
- File contents. Nothing is downloaded or scanned at the DNS layer.
- Direct-to-IP connections. Malware that connects straight to an IP address makes no lookup to block.
- Lookups that skip your resolver. Browsers or apps using their own DNS over HTTPS provider, hard-coded DNS servers or a personal VPN can route around the policy unless you control them.
- Compromised legitimate sites that are not yet on any threat list.
The usual fixes are a proxy or secure web gateway for full-URL and file inspection (see DNS filtering vs URL filtering), endpoint protection on every device, and firewall rules plus device policy that stop encrypted DNS bypass.
DNS security, DNS filtering, protective DNS and DNSSEC
These terms are often used interchangeably, but they mean different things:
| Term | What it means | What it protects |
|---|---|---|
| DNS security | The overall goal: stopping DNS being used against you or your domains | Users, devices and the domains you own |
| Protective DNS (PDNS) | A recursive resolver that refuses to resolve malicious domains | Users and devices making lookups |
| DNS filtering | Blocking domains by threat and content category, often for acceptable use | Users, safeguarding and productivity |
| DNSSEC | Digital signatures on DNS records so resolvers can verify answers | The integrity of DNS answers; it does not filter or encrypt |
| Encrypted DNS (DoH, DoT) | Lookups sent over HTTPS or TLS | Privacy of lookups on the network path |
Most organisations need the first three working together, with DNSSEC on their own domains and encrypted DNS pointed at their protective resolver rather than a public one.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
Next steps
To see how this applies to your organisation, start with our DNS security best practices checklist, then use the DNS security test guide to check what you have. If you are comparing services, DNS security solutions sets out the options we supply, including Cisco DNS-layer security, DNSFilter, Webroot, ThreatDown, Sophos and WatchGuard. If you would like us to look at your current set-up, contact us and we can suggest where to begin.
How Forever Systems helps with DNS security
We are an independent UK IT and cyber security provider and a Cisco Partner. We supply Cisco Umbrella and Cisco Secure Access DNS Defense, and a range of other DNS filtering options, so we can recommend what fits rather than one answer for everyone.
- Start with what you have: we look at your firewall, endpoint protection and Microsoft 365 licences first, as some already include DNS or web filtering
- Choosing a service: Cisco DNS-layer security, DNS filtering bundled with endpoint protection, or a protective DNS service from the public sector, compared in plain English
- Set-up and roll-out: network forwarding, roaming clients for laptops off site, policies, block pages and controls to stop encrypted DNS bypassing the filter
- Migration help, including planning a move from Umbrella DNS packages to Cisco Secure Access DNS Defense
- Ongoing help: policy changes, reporting reviews, licence management and renewals, agreed at quote
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
What is DNS protection?
DNS protection is a service that checks each domain a device looks up and blocks the lookup if the domain is linked to phishing, malware, command and control or content your policy does not allow. It is usually delivered by a protective DNS resolver plus an agent on devices that leave the office.
Why is DNS a security risk?
Traditional DNS is unencrypted, answers are not authenticated without DNSSEC, and outbound DNS is allowed almost everywhere. Attackers use it to deliver phishing and malware, to control infected devices and to move data out, and they target domain accounts to hijack websites and email.
What does DNS security block?
Phishing sites, malware hosting domains, command-and-control domains, newly registered domains if you choose, and content categories your policy blocks. Some services also detect DNS tunnelling and algorithmically generated domains.
Does DNS security replace antivirus?
No. DNS security stops connections to known bad domains, but it cannot scan files or stop malware that is already running or that connects straight to an IP address. Use it alongside endpoint protection.
Does DNS security slow down browsing?
It should not, when it is set up well. A protective resolver answers lookups much like any other resolver and caches common answers. Moving to a resolver that is a long way from your users, or a poorly configured internal set-up, can add delay, which is why deployment design matters.
What is DNS in cyber security?
In cyber security, DNS is both a channel attackers use, for phishing, malware delivery, command and control and data exfiltration, and a target they attack, through hijacking and spoofing. DNS security addresses both sides.
Still have a question about DNS security?
Ask us and a member of our team will reply by email.