What it means
DNS is both essential infrastructure and a valuable attack surface. Threats include spoofed responses, malicious domains, unauthorized record changes, tunneling, weak registrar controls, and misuse of resolver behavior.
Why it matters
When name resolution is compromised, users and systems can be redirected even when the destination name appears correct.
Practical focus
- Protect registrar and authoritative DNS accounts with strong controls
- Separate and monitor resolver, authoritative, and administrative roles
- Log and analyze unusual queries and newly observed domains
- Use DNSSEC and filtering where they fit the risk and architecture
Common mistakes
- Treating DNS as a simple utility with no security owner
- Blocking domains without considering evasion and business impact
- Ignoring external DNS and registrar dependencies
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: