Notifications
Clear all
Topic starter
23/06/2026 7:10 pm
TL;DR: Managed DNS centralises server management, orchestration, security, and failover, while self-managed DNS gives teams more control but shifts all outage, scaling, and attack-response burden in-house, according to DigiCert. The governance question is not convenience versus control, but where operational accountability, resilience, and security ownership sit across infrastructure and identity-adjacent access flows.
NHIMG editorial — based on content published by DigiCert: Navigating the DNS Landscape: Self-Managed vs. Managed DNS Solutions
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams govern DNS administration in managed environments?
A: Security teams should treat managed DNS administration as privileged access, not routine service configuration.
Q: Why does self-managed DNS create more operational risk for identity teams?
A: Self-managed DNS concentrates responsibility for availability, security, and recovery inside the organisation.
Q: What breaks when DNS access is not tied to ownership and offboarding?
A: DNS governance breaks when former staff, contractors, or automation jobs still retain the ability to change zones or failover settings.
Practitioner guidance
- Map DNS administration to privileged access Inventory every account, token, and operator that can modify zones, failover settings, or name server configuration.
- Review delegated provider access on a fixed cadence Confirm which staff, contractors, and automation identities can manage managed DNS dashboards and APIs.
- Protect automated DNS change paths Treat CI/CD jobs, deployment scripts, and API clients that update DNS as high-value non-human identities.
What's in the full article
DigiCert's full blog post covers the operational detail this post intentionally leaves for the source:
- A practical comparison of when self-managed DNS is still justified for internal Active Directory or highly customised environments.
- Provider-selection criteria for reliability, scalability, SLAs, and support that implementation teams can use during procurement.
- Operational trade-offs between in-house DNS administration, managed DNS dashboards, and registrar-hosted DNS.
- Guidance on how small businesses should evaluate free DNS hosting versus a managed service.
👉 Read DigiCert's comparison of self-managed and managed DNS for website reliability →
Managed DNS vs self-managed DNS: where do identity controls shift?
Explore further
25/06/2026 3:03 am
Managed DNS is an identity governance problem disguised as an infrastructure choice. The article presents a familiar availability trade-off, but the real control boundary is who can modify authoritative state and recover from failure. Once record changes move through APIs, dashboards, or delegated operators, DNS administration becomes a privileged workflow with all the usual NHI risks: stale access, excessive privilege, and weak offboarding. Practitioners should treat DNS as governed access, not just hosted service selection.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
A question worth separating out:
Q: What is the difference between managed DNS delegation and handing over accountability?
A: Delegation shifts the operational work to a provider, but accountability for domain integrity stays with the organisation. Teams still need to know who can make changes, how access is revoked, and how recovery works if provider access is disrupted. Managed service does not remove the need for identity governance over the people and systems using it.
👉 Read our full editorial: Managed DNS trade-offs are really identity and resilience trade-offs
