Notifications
Clear all
Topic starter
23/06/2026 7:15 pm
TL;DR: DNS reliability is not just uptime but a mix of latency, redundancy, security and visibility, and DigiCert notes UltraDNS processed nearly 42 trillion queries in 2023 while one study found 82% of businesses saw DNS-based attacks lead to application outages. The real test is whether smaller teams can govern this dependency without creating new failure points.
NHIMG editorial — based on content published by DigiCert: Scaling Smart: How SMBs Can Achieve Enterprise-Grade Reliable DNS on a Budget
By the numbers:
- UltraDNS processed nearly 42 trillion DNS queries in 2023 alone.
- DNS-based attacks led to application outages in 82% of businesses.
- Domain name registrations reached 368.4 million.
Questions worth separating out
Q: How should security teams evaluate DNS reliability for identity-dependent systems?
A: Start by mapping which identity services depend on DNS, including SSO, federation, certificate validation, and workload discovery.
Q: Why does DNS reliability matter for IAM and workload identity programmes?
A: Because DNS sits underneath the services that issue, validate, and resolve trust.
Q: What breaks when DNS controls are treated as a commodity service?
A: Teams often discover that low-cost DNS lacks visibility, failover transparency, and security depth.
Practitioner guidance
- Map DNS dependencies across identity flows Inventory where DNS resolution supports SSO, federation endpoints, certificate validation, workload discovery, and API connectivity so outages are measured as identity-impacting events, not just network incidents.
- Test provider redundancy with failure drills Verify how the service behaves when a PoP, region, or resolver path fails, and confirm that traffic reroutes without breaking authentication or application reachability.
- Require security controls that preserve trust Make DNSSEC, DDoS mitigation, and encrypted resolution part of the baseline evaluation so availability and integrity are assessed together during vendor review.
What's in the full article
DigiCert's full blog covers the operational detail this post intentionally leaves for the source:
- The article breaks down Anycast architecture and failover design in more practical detail for teams comparing providers.
- It explains the difference between latency, caching, and availability in a way that helps non-network specialists assess service quality.
- It outlines the cost and support trade-offs SMBs face when moving beyond bundled or low-tier DNS services.
- It adds provider-selection criteria for teams that need a procurement checklist rather than a conceptual overview.
👉 Read DigiCert's analysis of reliable DNS for SMBs →
Reliable DNS for SMBs: are your resilience controls keeping up?
Explore further
25/06/2026 3:11 am
DNS reliability is now an identity dependency, not just a network property. Modern IAM, federation, certificate validation, and workload connectivity all rely on DNS to resolve the services they trust. When teams separate DNS governance from identity governance, they miss how quickly lookup failure becomes access failure. Practitioners should treat DNS resilience as part of the control plane that keeps identity services reachable.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who should own DNS governance in an identity-heavy environment?
A: Ownership should sit with a shared governance model that includes infrastructure, security, and identity stakeholders. DNS affects access paths, certificate trust, and workload availability, so leaving it outside identity oversight creates blind spots. Accountability should be explicit before an outage exposes the gap.
👉 Read our full editorial: Reliable DNS for SMBs: what enterprise-grade resilience really means
