Topic starter
25/10/2026 11:08 am
TL;DR: DNS remains a primary attack path because resolution happens before most security controls see the connection, letting phishing pages, malware downloads and command-and-control traffic reach users, according to CyberFOX. The governance gap is not name resolution itself but the absence of policy at the resolution layer, where trust is first decided.
Editorial analysis by NHI Mgmt Group, based on content published by CyberFOX: “What Is DNS Security?”.
Key questions
Q: What are the best practices for using DNS filtering to reduce phishing and malware exposure?
A: Use DNS filtering as a policy layer, not a standalone control.
Q: Why is DNS a useful control point for malware and command-and-control traffic?
A: Because almost every internet connection starts with a lookup, DNS gives defenders a chance to stop the session before it begins.
Q: What are the signs that DNS tunnelling is being used for command and control?
A: Common signs include high volumes of structured subdomain queries, repeated lookups to a single parent domain, and process activity that aligns with unusual outbound resolution.
Practitioner guidance
- Enforce resolution-stage blocking for known malicious domains Apply category-based and per-domain controls before the connection opens, so phishing pages, malware hosts and C2 domains never resolve for users or devices.
- Hunt for tunnelling and DGA patterns in DNS logs Review query volume, failed lookups and high-entropy domains for signs of covert data movement or malware staging, especially from roaming endpoints.
- Extend DNS policy to roaming devices Make sure laptops and mobile devices keep the same DNS protections when users work from home networks or public Wi-Fi rather than the office perimeter.
Bottom line: Attackers abuse DNS because resolution happens before most other security layers can judge whether a destination is safe.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →