DNS Security Explained: DNSSEC, DoH, DoT and Filtering
DNS, the Domain Name System, translates names like example.com into IP addresses, and attackers abuse it to redirect users, steal data, or take sites offline. DNS security combines protecting the records you publish, securing the resolvers your users rely on, and filtering malicious lookups.
Because nearly every connection starts with a DNS query, a weakness here affects everything that follows.
How DNS works in brief
When you type a web address, your device asks a recursive resolver, usually run by your internet provider, company, or a public service. The resolver queries a chain of authoritative servers that hold the official records for each domain and returns the answer. Results are cached for a period set by each record’s time-to-live (TTL).
Traditional DNS is unencrypted and unauthenticated, which creates two issues: others on the path can see your queries, and a forged answer can be accepted as genuine.
Common DNS attacks
- Cache poisoning: inserting false data into a resolver so users are sent to a malicious address.
- DNS hijacking: changing DNS settings on a router, device, or domain registrar account so queries or records point somewhere else.
- Domain takeover: abusing dangling records, such as a CNAME that points to a cloud service you no longer use, to claim the destination.
- DNS tunneling: hiding data inside DNS queries to sneak information out of a network or control malware.
- Amplification DDoS: abusing open resolvers to flood a victim with traffic.
- Registrar account compromise: an attacker who logs into your registrar can change nameservers and take control of the entire domain.
DNSSEC: authenticity for DNS answers
DNSSEC adds digital signatures to DNS records. A validating resolver can check that an answer really came from the domain’s authoritative source and was not modified. It protects integrity, not privacy: queries are still visible. Deployment requires signing the zone and publishing a delegation signer record at the parent registry, and mistakes in key management can make a domain unreachable, so follow your DNS provider’s guidance and monitor expiry of signatures.
Encrypted DNS: DoT and DoH
DNS over TLS (DoT) and DNS over HTTPS (DoH) encrypt the connection between a device and its resolver, preventing eavesdropping and tampering on the local network. DoT uses a dedicated port, which makes it easy for administrators to identify; DoH blends into regular HTTPS traffic. Neither hides your lookups from the resolver itself, so choose a resolver you trust.
In organizations, uncontrolled DoH can bypass internal filtering. Many teams configure approved encrypted resolvers on managed devices and block unapproved ones at the firewall.
DNS filtering
A filtering resolver refuses to resolve domains known to host malware, phishing, or command-and-control infrastructure. Because it works before a connection is made, it protects every device using the resolver, including those you cannot install software on. Filtering is not perfect, since new malicious domains appear constantly, but it is a low-effort, high-value layer. Logging DNS queries also helps investigators identify infected devices that contact suspicious names.
Protecting your own domain
- Secure the registrar account with a unique password and strong multi-factor authentication.
- Enable registrar lock to prevent unauthorized transfers.
- Use a reputable DNS host with access controls and audit logs.
- Enable DNSSEC where supported and monitored.
- Remove dangling records that point to retired services.
- Publish email authentication records (SPF, DKIM, DMARC) to reduce spoofing of your domain.
- Keep registration contact details current and set renewals to automatic so the domain never lapses.
Protecting your network
On your side, restrict which devices can query external resolvers, disable open recursion on any DNS server you run, use a filtering resolver, and monitor for unusual query volume or very long, random-looking names that suggest tunneling.
Monitoring DNS for signs of trouble
DNS logs are a rich source of security information. Because almost every program resolves a name before connecting, the queries reveal what each device is trying to reach. Look for devices querying domains that were registered very recently, unusually long or random-looking names, high volumes of queries for non-existent domains, and queries to unfamiliar resolvers that bypass your own. Any of these can indicate malware, tunneling, or misconfigured software. Even without a dedicated security platform, simply retaining resolver logs for a few weeks gives you evidence to investigate a suspected incident later.
Finally, remember that DNS changes are high-impact. Require approval for modifications to critical records, and set alerts for unexpected changes to nameserver, mail, and root-level records.
Frequently asked questions
Is DNSSEC the same as encrypted DNS?
No. DNSSEC verifies that answers are authentic and unmodified. DoH and DoT encrypt the path between you and your resolver. They solve different problems and can be used together.
Does DoH make me anonymous?
No. It hides queries from observers on the network path, but your chosen resolver can still see them, and the sites you visit still see your connection.
What is the most common DNS-related breach?
Account compromise at the registrar or DNS host is a frequent and damaging route, because it gives attackers full control of where a domain points. Strong MFA and registrar lock are the best defenses.
Key takeaways
- DNS is unauthenticated and unencrypted by default, so it needs extra protection.
- DNSSEC protects answer integrity; DoH and DoT protect privacy in transit.
- Secure your registrar account with MFA and lock; audit records regularly.
- DNS filtering is an inexpensive layer that protects all devices on a network.
