DNS should be your next security priority: Lessons from NIST

Recent updates from the National Institute of Standards and Technology (NIST) have brought critical attention to a crucial yet often overlooked component of network security: the Domain Name System (DNS). The proposed revision to NIST Special Publication 800-81r3 signals a significant shift in how organizations should approach cybersecurity. What was once viewed as primarily a network service is now recognized as a powerful tool for defending against increasingly sophisticated cyber threats: Secure DNS is foundational to cybersecurity and a key element of zero trust architectures.

DNS plays a fundamental role in how the internet functions, serving as the backbone of network connectivity that enables organizations to seamlessly interact with the digital world. Yet this critical system has become an attractive target for cybercriminals. According to former U.S. cybersecurity official Anne Neuberger, a staggering 92% of malware attacks exploit DNS infrastructure in some capacity.

A case in point is the global cybercriminal network known as Vextrio Viper, which controls over 70,000 malicious domains on behalf of a web of dozens of malicious affiliates. Using DNS-based exploitation tactics, the network distributes malware, runs scams and orchestrates large-scale fraud campaigns, often bypassing traditional security measures. Adding to that, government cyber agencies have even recently issued advisories about DNS exploitation techniques like Fast Flux. Given that attackers are exploiting DNS infrastructure to bypass traditional defenses, leveraging DNS-based intelligence is crucial to detecting and stopping these threats.

NIST’s updated best practices emphasize that DNS is a critical component of any organization’s security strategy. The guidance rests on three foundational pillars: implementing protective DNS, securing the DNS protocol, and fortifying DNS infrastructure. Together, these components form the overarching concept of “secure DNS.” Adopting these guidelines not only strengthens an organization’s cyber defenses but also enhances its resilience against an increasingly sophisticated threat landscape. These three pillars form the cornerstone of an effective secure DNS strategy, and the following advantages underscore why aligning with them is essential.

Preventing threats before they occur: Proactive protection through protective DNS

One of the key benefits of implementing protective DNS is enhanced security capabilities to block malicious delivery of malware, ransomware, phishing attacks and more. Protective DNS works by analyzing DNS queries and responses, taking proactive action to prevent access to known harmful sites.

The most successful protective DNS capabilities identify dangerous activity even if the attackers’ infrastructure has not previously been deployed for malicious purposes, even as cybercriminals use sophisticated techniques to circumvent other security tools. Helpfully, NIST defines the outcomes of protective DNS in its updated guidance, including real-time blocking of harmful network traffic and delivering visibility into DNS query and response data to facilitate incident response. This strategy significantly reduces the risk of an attack, blocking cybercriminals before they can deliver malicious payloads without disrupting access to legitimate internet traffic.

Organizations can deploy protective DNS solutions in several ways, including through third-party services or by using internally managed DNS infrastructure. In fact, NIST recommends a combination of both approaches to provide a more comprehensive defense strategy.

Enhancing DNS integrity: Securing the DNS protocol

The DNS protocol, which underpins critical internet services such as web browsing and email, has long been a weak point in many organizations’ security postures because traditional security platforms, such as next-generation firewalls, often allow DNS traffic to pass without inspection.

Organizations can significantly improve their security by employing techniques to secure DNS traffic and prevent exploitation. This includes using Domain Name System Security Extensions (DNSSEC) to ensure the integrity of DNS responses with cryptographic signatures, making it much harder for attackers to tamper with DNS data, and implement Transaction Signatures (TSIG) for secure communication between DNS servers, ensuring that both sides are trusted and messages cannot be altered in transit. DNS traffic encryption provides confidentiality and protects against man-in-the-middle attacks.

Monitoring for “lookalike” domains — subtle variations of legitimate websites often used in phishing attacks — allows organizations to proactively detect and mitigate malicious activity before it reaches end users. Continuously monitoring for outdated DNS records — which can be exploited by attackers as entry points into critical systems — reduces attack surface and makes it harder for adversaries to infiltrate their networks.

By implementing these robust DNS security and hygiene best practices recommended by NIST, organizations gain greater visibility into their DNS traffic, enabling them to identify potential threats and vulnerabilities before they can escalate. Together, these practices ensure that DNS traffic remains secure, private and resilient against modern cyber threats.

Ensuring operational continuity and resilience: Fortifying DNS infrastructure

As DNS is foundational to the functioning of modern networks and applications, its infrastructure must be secure and resilient. Organizations that invest in protecting their DNS infrastructure gain significant advantages, particularly against Distributed Denial of Service (DDoS) attacks, which can overwhelm DNS servers and disrupt access to critical services. A DDoS attack on the network can cost organizations at least $218K, not including added losses such as potential lost revenue.

To defend against such attacks, organizations benefit from separating DNS services from other core systems to reduce the impact of a breach on multiple systems. Moreover, hardening DNS servers by limiting open ports, disabling unnecessary services, and applying regular security patches further protects against vulnerabilities.

Implementing high availability and redundancy ensures that DNS services remain operational even during an attack. Continuous monitoring of DNS traffic is another critical component, helping organizations detect abnormal behavior or signs of attack in real-time, which further fortifies their security posture.

Embracing the path forward

The proposed updates to the best practices in NIST 800-81r3 represent more than just a 12-year refresh of technical standards; they mark a strategic evolution in how organizations should think about cybersecurity. As cyber threats grow more sophisticated and persistent, DNS can no longer be treated as solely a network connectivity technology. It must be recognized for what it is: a critical cybersecurity control point and a frontline defense.

Coleman Mehta is head of global public policy and strategy at Infoblox.