Notifications
Clear all
Topic starter
23/06/2026 7:02 pm
TL;DR: Secondary DNS uses two authoritative providers so zone updates synchronise automatically and queries can fail over if the primary DNS provider goes down, helping avoid resolution errors, DDoS-related outages, and the downtime costs highlighted by DigiCert. For identity and access teams, availability is part of governance because domain failure can disrupt authentication, tooling, and business operations.
NHIMG editorial — based on content published by DigiCert: Secondary DNS for Domains in High Demand
By the numbers:
- As much as 88% of consumers who have just one bad experience with a brand's website are less likely to return.
Questions worth separating out
Q: How should security teams implement Secondary DNS for identity-facing domains?
A: Start with the domains that support authentication, federation, certificates, and workload discovery.
Q: Why does DNS redundancy matter for IAM and NHI programmes?
A: Because DNS is the layer that lets identity services be found and reached.
Q: What breaks when a domain relies on one DNS provider only?
A: A single-provider setup creates a single point of failure for resolution.
Practitioner guidance
- Map DNS dependencies for identity services Inventory every login, federation, certificate, and workload endpoint that depends on public or internal DNS resolution, then mark which ones would fail if the primary provider became unavailable.
- Provision a secondary authoritative DNS provider Use a second authoritative nameserver set for domains that support authentication, user access, or machine-to-machine trust so resolution can continue during provider-side outages.
- Test zone synchronisation and failover behaviour Validate that zone files replicate cleanly, records resolve consistently, and query handling shifts as expected when the primary provider is withdrawn from service.
What's in the full article
DigiCert's full blog covers the operational detail this post intentionally leaves for the source:
- The cost comparison method used to contrast outage losses with Secondary DNS pricing
- The historical outage examples cited across major DNS and cloud providers
- The provider feature checklist, including DNSSEC and query logs, that supports implementation decisions
- The inventory of large websites still relying on a single DNS provider
👉 Read DigiCert's blog on Secondary DNS for domains in high demand →
Secondary DNS and outage resilience: is your domain protected?
Explore further
25/06/2026 2:50 am
Secondary DNS is an availability control that identity teams still underuse. The article frames DNS redundancy as a way to avoid outage-driven downtime, but the deeper lesson for identity security is that availability depends on the same dependency mapping used for access governance. If resolution fails, authentication, federation, and workload reachability can all fail upstream. Practitioners should treat DNS resilience as part of identity service governance, not a separate web operations concern.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
A question worth separating out:
Q: Who should own DNS resilience in an identity programme?
A: Ownership should sit with the teams that govern service continuity for identity-adjacent systems, usually IAM, platform, and infrastructure security together. DNS resilience affects trust, reachability, and recovery, so it needs shared accountability rather than a handoff to web operations alone.
👉 Read our full editorial: Secondary DNS for domain resilience and outage avoidance
