Notifications
Clear all
Topic starter
23/06/2026 7:07 pm
TL;DR: DNS spoofing, DDoS, pharming, and outages can disrupt online banking, redirect customers, and erode trust, according to DigiCert’s analysis of managed DNS for financial institutions. For identity teams, DNS is part of the control plane for access, availability, and trust, not just infrastructure plumbing.
NHIMG editorial — based on content published by DigiCert: Securing the Foundations: The Critical Role of DNS for Banks and Financial Organizations
Questions worth separating out
Q: How should banks govern DNS as part of identity and access security?
A: Banks should treat DNS as part of the trust path that supports identity, not as a separate infrastructure concern.
Q: Why do DNS failures create identity security risk for financial organisations?
A: DNS failures can stop users reaching login pages, redirect them to malicious destinations, or break federation and transaction flows.
Q: What breaks when DNSSEC is not operationally maintained?
A: DNSSEC loses value when signing, key rotation, or validation is inconsistent.
Practitioner guidance
- Map DNS into the identity trust path Document where DNS resolution sits in login, federation, and transaction flows so incidents can be triaged as trust-path failures, not just infrastructure outages.
- Validate DNSSEC key and signing operations Review who signs zones, who rotates keys, and how validation is monitored across authoritative and recursive layers before an outage or spoofing event exposes the gap.
- Test banking domains under DDoS conditions Run load and failover exercises against authoritative DNS so teams can confirm mitigation, redundancy, and resolver behavior for critical customer-facing domains.
What's in the full article
DigiCert's full blog covers the operational detail this post intentionally leaves for the source:
- DNSSEC implementation details for banking domains and how the signing chain is structured
- DDoS mitigation mechanics for authoritative DNS and how traffic analysis supports filtering
- Global load balancing and traffic steering examples that show how resilience decisions are applied
- Product-specific guidance for deploying managed DNS in financial environments
👉 Read DigiCert's analysis of DNS security for banks and financial organisations →
DNS resilience for banking: what IAM teams should watch?
Explore further
25/06/2026 2:58 am
DNS resilience is part of identity trust, not separate from it. Banking users do not experience DNS, certificates, and access control as isolated layers. They experience a single trust path from name resolution to login and transaction. When DNS is unreliable or manipulated, the identity journey fails before authorization even begins, which is why IAM and security governance should treat DNS as part of the access surface.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own DNS resilience decisions in a bank?
A: DNS resilience should be jointly owned by infrastructure, security, and identity teams because it affects access paths, routing, and trust validation. Clear ownership prevents gaps where outages are handled as network issues even though they directly affect customer authentication and service access.
👉 Read our full editorial: DNS resilience for banks is now an identity governance issue
