Notifications
Clear all
Topic starter
23/06/2026 7:02 pm
TL;DR: DNS analytics and query logs give operators real-time and historical visibility into domain activity, including raw logs, charts, maps, and 30-minute location data, according to DigiCert. That visibility is useful for troubleshooting misconfigurations, spotting unusual traffic patterns, and detecting DNS-based attacks, but it does not replace identity governance or access controls.
NHIMG editorial — based on content published by DigiCert: Real-time DNS Analytics: Product Spotlight
Questions worth separating out
Q: How should security teams use DNS analytics in an identity programme?
A: Security teams should use DNS analytics as supporting evidence for service behaviour, not as a replacement for identity governance.
Q: Why do DNS query logs matter when investigating misconfigurations?
A: DNS query logs show which records were queried, from where, and with what protocol details, which makes them valuable for separating expected use from abnormal behaviour.
Q: When should teams prefer real-time DNS analytics over historical snapshots?
A: Teams should prefer real-time analytics when they need to catch active surges, validate a recent configuration change, or watch for DNS-based attack behaviour as it unfolds.
Practitioner guidance
- Baseline normal query behaviour Capture per-domain query volume, location spread, and record usage so that spikes and anomalies can be compared against ordinary patterns.
- Use raw logs during change validation Review query logs after DNS configuration changes to confirm that record type, source address, and record usage match the intended design.
- Track unused and excessive records Identify records that are rarely queried or suddenly generating excess activity, then reconcile them with service ownership and deployment history.
What's in the full article
DigiCert's full product spotlight covers the operational detail this post intentionally leaves for the source:
- Step-by-step views of account analytics, domain analytics, and query traffic logging.
- Filter options for raw query logs, including city, EDNS client IP version, record name, and source address.
- Operational examples showing how teams can use real-time stats to troubleshoot unusual DNS behaviour.
- How the analytics views help identify DDoS patterns, configuration errors, and record-level usage trends.
👉 Read DigiCert's product spotlight on real-time DNS analytics →
DNS analytics and query logs: what do IAM teams need to know?
Explore further
25/06/2026 2:49 am
DNS analytics are an infrastructure visibility control, not an identity control, but they still matter to identity teams. DNS query data often shows the side effects of poor service governance before teams see direct identity abuse. That makes DNS telemetry useful for validating workload behaviour, record usage, and unexpected dependency patterns. Practitioners should treat it as a supporting signal inside broader identity and service governance.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to The State of Secrets in AppSec.
A question worth separating out:
Q: What is the difference between DNS visibility and identity governance?
A: DNS visibility shows how records and traffic behave, while identity governance controls who or what should be allowed to access systems and services. The two are complementary. DNS can reveal unexpected service use, but only identity governance can define ownership, entitlement, and lifecycle responsibility.
👉 Read our full editorial: DNS analytics expose infrastructure usage patterns and attack signals
