DNS protection and the governance gap teams still miss

TL;DR: DNS requests remain a heavily targeted attack path, with IDC-cited figures quoted by DNSFilter showing 88% of organisations experienced one or more DNS attacks in 2023 at an average cost of $942,000 per successful incident. Protective DNS shifts blocking and verification to the lookup layer, where phishing, ransomware callbacks, and command-and-control traffic first appear.

Editorial analysis by NHI Mgmt Group, based on content published by DNSFilter: “The Advantages of DNS Security and How DNS Protection Delivers Them”.

By the numbers:

• 88% of organizations experienced one or more DNS attacks in 2023, according to an IDC study reported by DNSFilter.

Key questions

Q: How should security teams use DNS filtering in a Zero Trust architecture?

A: Use DNS filtering as an early enforcement point, not as a substitute for identity or endpoint controls.

Q: Why does DNS matter so much for phishing and ransomware defence?

A: Because the malicious destination often appears first as a domain lookup.

Q: What are the signs that DNS controls are not giving enough visibility?

A: Common signs include unexplained SaaS usage, lookup spikes to unfamiliar domains, and gaps between endpoint alerts and what the network team sees in logs.

Practitioner guidance

• Define DNS as an enforcement layer Set policy for malicious, suspicious, and high-risk domains at the resolver or recursive DNS layer so blocked lookups fail before the session starts.
• Integrate DNS logs into detection workflows Send query telemetry into SIEM and threat hunting pipelines so analysts can spot unusual destinations, shadow IT, and exfiltration patterns early.
• Map DNS policy to Zero Trust decisions Use DNS controls alongside identity and device checks so destination trust is evaluated as part of the access path, not after connection establishment.

Bottom line: DNS security belongs closer to the start of the access path than many programmes currently place it, because threats often begin with a lookup.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →