Rethinking DNS security: lessons from NIST

DNS security gets overlooked more often than it should. A Brisbane professional services firm we work with had strong endpoint protection, multi-factor authentication (MFA), and regular patching in place. What they hadn’t reviewed in years was their DNS configuration. A routine IT audit found exposed recursive resolvers and no protective DNS filtering in place at all.

That gap matters more now than it ever has. NIST published the final version of its Secure DNS Deployment Guide, SP 800-81r3in March 2026, replacing a version that had not been updated since 2013. The message is clear: DNS is no longer passive infrastructure. It is an active security control, and businesses that treat it as basic plumbing are leaving a significant gap in their defence.

DNS: no longer just infrastructure

DNS (Domain Name System) translates domain names into IP addresses. Every time one of your staff opens a browser, sends an email, or connects to a cloud service, DNS is involved. That ubiquity is precisely why attackers target it.

Here is what makes DNS security uniquely important in 2026:

• Attackers use DNS as a covert communications channel, through DNS tunnelling and DNS over HTTPS (DoH) abuse.
• DNS resolves the malicious domains used in phishing, ransomware delivery, and command-and-control communications.
• Misconfigured DNS allows domain hijacking, cache poisoning, or unauthorised changes to your DNS records.
• DNS logs are a rich source of threat intelligence, when monitored properly.

The ASD’s Annual Cyber Threat Report 2024-25 recorded over 1,200 cyber incident responses and put the average cost to Australian businesses at $80,850 per incident. DNS is involved in the majority of those attack chains, either as the delivery mechanism or as a channel attackers use once they are inside.

What the updated NIST guidance actually says

NIST SP 800-81r3, published in final form on 19 March 2026, replaced guidance that had not been updated for over twelve years. It was co-authored with Infoblox to ground the recommendations in operational reality rather than theory. The document covers three areas: using DNS as an active security control, securing the DNS protocol itself, and protecting the servers and infrastructure that run DNS services.

Four security functions sit at the core of the updated guidance:

• Policy enforcement point (PEP): DNS can block access to known-malicious domains and stop data leaving your network.
• Visibility: DNS traffic shows potential threats early. Anomalies often show up in DNS logs before they appear anywhere else.
• Integrity control: Validating DNS responses protects against manipulation and spoofing.
• Confidentiality: Encrypting DNS queries stops them being intercepted and misused.

These functions lift DNS from background utility to a genuine security layer, one that sits alongside your firewall, endpoint protection, and identity controls.

Key threats that DNS security addresses

DNS spoofing and cache poisoning

Attackers manipulate DNS responses to redirect legitimate traffic to malicious sites. DNSSEC (Domain Name System Security Extensions) counters this by ensuring responses are cryptographically signed and verified. The updated NIST guidance modernises the DNSSEC algorithm recommendations, now favouring ECDSA and Edwards-curve algorithms over RSA, because their smaller key sizes keep DNS responses efficient and avoid fallback to TCP.

DNS tunnelling

Tunnelling lets attackers bypass security controls and move data out of your network inside DNS queries. It is difficult to spot without active log analysis. NIST recommends tight monitoring of DNS traffic patterns to detect tunnelling early. Our network management services include exactly this kind of ongoing traffic review.

Encrypted DNS misuse (DoH and DoT)

DNS over HTTPS (DoH) and DNS over TLS (DoT) protect query confidentiality, but they also create blind spots if traffic bypasses your security stack. NIST advises organisations to route endpoints through sanctioned internal resolvers and to monitor encrypted DNS channels for anomalies. Our IT security assessments verify whether your infrastructure enforces these controls correctly.

Dynamic DNS abuse

Allowing unauthorised dynamic updates can result in compromised zones and rogue DNS records. TSIG (Transaction SIGnature) authentication is the standard control. We check for this during IT audits as a matter of course, it is more often misconfigured than not.

Infrastructure vulnerabilities

Running DNS on shared infrastructure alongside Active Directory or file services creates unnecessary risk. NIST SP 800-81r3 is explicit: DNS servers should run on dedicated infrastructure, separate from other services. It also recommends separating authoritative and recursive DNS functions, since combining them on an internet-facing server is a security risk in itself.

Best practices from NIST SP 800-81r3

Harden DNS infrastructure

• Separate DNS from other infrastructure functions, no shared servers with Active Directory, file sharing, or similar services.
• Deploy at least two authoritative name servers on different network segments, ideally across different physical sites.
• Use a hidden primary authoritative server that does not appear in public NS records, to reduce exposure to direct attack.
• Harden operating systems and disable unnecessary services on DNS hosts.

Put DNSSEC in place

• Validate DNSSEC signatures on recursive resolvers.
• Sign authoritative zones and maintain regular key rotation. NIST recommends RRSIG validity periods of five to seven days, to limit exposure if a key is compromised.
• Use hardware security modules (HSMs) to store private key-signing keys where practical.

Handle encrypted DNS carefully

• Deploy DoT or DoH for client privacy, but ensure endpoints resolve only through approved internal resolvers.
• Monitor encrypted traffic patterns for misuse and anomalies.
• Configure browsers and applications carefully so they do not bypass internal DNS controls.

Deploy Protective DNS

Protective DNS (PDNS) is a DNS resolver enhanced with threat intelligence. It blocks resolutions to malicious domains, phishing, malware command-and-control, data exfiltration, in real time. NIST SP 800-81r3 gives Protective DNS significant attention as a practical, high-value control. TTA’s DNS filtering service delivers this capability for Queensland SMEs without requiring new hardware or complex configuration changes.

Log and monitor DNS traffic

• Log all DNS queries and responses across internal and external resolvers.
• Integrate DNS logs with your SIEM or security monitoring platform, and correlate with DHCP lease data to map activity to specific devices.
• Use DNS data as part of threat detection and incident response through managed network services.

How DNS security fits into 2026 environments

DNS and zero trust

NIST SP 800-81r3 explicitly ties DNS to zero trust architecture, treating DNS as both a policy enforcement point and an information source when evaluating access requests. DNS filtering, encryption, and logging become part of your access control policies, not just security hygiene. Our IT consulting services help clients build practical zero trust strategies that include DNS as a first-class control.

Cloud and hybrid DNS challenges

With workloads split across on-premises, SaaS, and cloud platforms, consistent DNS security becomes harder to maintain. NIST recommends a hybrid approach where cloud services are combined with on-premises fallback to ensure resilience during outages. This typically means centralised DNS resolvers for hybrid environments, DNSSEC enforced through cloud-native services, and DNS monitoring extended across all workloads, not just what sits on-premises.

What we see at TTA: DNS gaps in Queensland SMEs

Across the businesses we work with in South-East Queensland, DNS is the security control most likely to be set and forgotten. Most have some form of firewall and endpoint protection. Far fewer have Protective DNS filtering in place, and almost none have reviewed their DNSSEC configuration since their domain was first registered. These are not complex fixes, but they require someone to actually check. That check rarely happens without a structured audit or a managed service that covers DNS as part of ongoing network security.

Operational resilience

DNS outages are business continuity risks, not just security risks. NIST recommends redundancy, failover configurations, and distributed DNS architecture to maintain availability. Separating authoritative and recursive infrastructure means one failure does not take down both services at once. Our data security services treat DNS continuity as part of the broader resilience picture.

A practical checklist for Australian businesses

If you haven’t reviewed DNS security recently, these are the questions worth asking:

• Are your authoritative and recursive DNS functions separated?
• Do you have Protective DNS filtering in place, blocking known-malicious domains?
• Is DNSSEC enabled and are signing keys rotated on a documented schedule?
• Are DNS logs captured, retained, and reviewed as part of your security monitoring?
• Do your endpoints resolve through sanctioned internal resolvers, or can they bypass your security stack via DoH?

FAQ: DNS security for Australian SMEs

What is DNS security and why does it matter for my business?

DNS security covers the controls that protect your Domain Name System from being misused by attackers. DNS is involved in nearly every network connection your business makes. Attackers use it to deliver malware, exfiltrate data, and run command-and-control communications. Securing DNS reduces your exposure to phishing, ransomware, and data theft at the network level, before threats reach endpoints or inboxes.

What is Protective DNS and how does it work?

Protective DNS (PDNS) is a DNS resolver with built-in threat intelligence. When a device tries to connect to a known-malicious domain, for example, a phishing site or a ransomware command server, the PDNS resolver blocks the query before a connection is made. It works silently in the background and requires no changes to end-user devices. NIST SP 800-81r3, published in March 2026, gives Protective DNS significant attention as a practical, high-value control.

Does my small business really need DNSSEC?

DNSSEC protects the integrity of DNS responses by ensuring they haven’t been tampered with in transit. For businesses that rely on email (and that is every business), DNSSEC helps underpin DMARC and email authentication. If your domain was registered years ago, there is a reasonable chance DNSSEC was never configured. An IT audit will tell you quickly whether it is in place and whether signing keys are being rotated correctly.

How does DNS filtering differ from a firewall?

A firewall controls traffic based on IP addresses, ports, and protocols. DNS filtering works at the domain query level, it blocks connections to malicious domains before an IP connection is even established. The two controls are complementary. DNS filtering catches threats that use freshly registered domains or rotate IPs rapidly, which firewalls relying on IP blocklists can miss.

What is the first step if we haven’t reviewed DNS security before?

Start with a structured IT security assessment that includes your DNS configuration, logging, and filtering controls. That gives you a clear picture of where the gaps are before deciding what to address first. For most Queensland SMEs, the highest-value quick wins are enabling Protective DNS filtering and verifying that DNS logs are being captured and reviewed as part of ongoing monitoring.

Where to from here?

In Part 2, we explore how these NIST recommendations align with the ACSC Essential Eight and provide a practical roadmap for Australian businesses. For tailored advice on DNS security assessments or managed solutions, get in touch with the TTA team.