DNS matters because it underpins name resolution and is widely abused for phishing, command-and-control, tunnelling, and data leakage. Security teams monitor resolver activity, domain reputation, fast-flux behaviour, unusual query patterns, and changes to critical records. They also protect against cache poisoning, registrar abuse, and unauthorised record changes.
Why DNS sits on the security critical path
DNS is not just an internet plumbing service, it is the control plane that lets users and systems find everything else. That makes it a high-value trust boundary for phishing, malware delivery, and traffic redirection. A security team that ignores DNS loses one of the fastest ways to see domain abuse, infrastructure changes, and malicious resolution paths.
Because DNS is both foundational and observable, it gives defenders a practical view of intent. Suspicious lookups, rare domains, rapid changes in answers, and resolver abuse often appear before a full compromise becomes obvious. That is why DNS telemetry is useful not only for blocking known-bad destinations, but also for detecting infrastructure patterns that support staging, persistence, and exfiltration.
What security teams watch in DNS telemetry
Security teams usually get the most value from DNS when they treat it as behaviour data, not just a list of blocked domains. Resolver logs can show volume spikes, odd query types, algorithmic domain generation, and unusually short-lived records. Those signals matter because they often indicate either an automated abuse pattern or a change in attacker infrastructure that reputation feeds have not yet absorbed.
Good DNS monitoring also looks at the surrounding control surface, not only the query. Changes to authoritative records, registrar settings, name server delegation, and wildcard behaviour can reveal hijacking or misdirection. In practice, the question is not only whether a domain was queried, but whether the domain still resolves to the expected infrastructure and whether that infrastructure was changed through a legitimate process.
Why DNS control failures become security incidents
DNS failures are dangerous because they can redirect trust at scale. If a resolver is poisoned, a registrar account is abused, or a zone is edited without authorization, users can be sent to attacker infrastructure without changing the endpoint itself. That makes DNS attractive for credential theft, command-and-control, and covert data movement, especially when defenders only inspect endpoints and ignore resolution behavior.
DNS also becomes a quiet exfiltration channel when controls are weak. Small chunks of data can be embedded in queries, and the traffic can blend into normal network noise if teams do not baseline what “normal” looks like for their environment. The challenge is less about raw volume and more about spotting when resolution patterns stop matching business reality.
Risk and Threat Considerations
DNS is a shared dependency, so a mistake in one place can create broad exposure across users, workloads, and third-party connections. Attackers exploit that centrality because a single compromised record, poisoned cache, or abused registrar account can redirect many victims at once, often before endpoint defenses notice the change.
Failure mechanism: A threat actor alters resolution, abuses name server trust, or hides activity in normal-looking query traffic, then uses that path to steer users to hostile infrastructure or to move data out through DNS.
Impact: The result can be credential capture, command-and-control persistence, missed detection, and trust in legitimate domains being undermined across the environment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | DNS telemetry and resolver abuse are network-defense signals. |
| Recommendation — Monitor DNS logs and resolver activity for suspicious query patterns and domain abuse. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitored networks and network services are continuously monitored to discover potential cybersecurity events | DNS monitoring is a core continuous-monitoring use case. |
| PR.DS-01 — Data-at-rest is protected | Authoritative DNS records and zone data must be protected from unauthorized changes. | |
| Recommendation — Continuously monitor DNS infrastructure and traffic for anomalies and abuse. Protect zone data and critical DNS records against unauthorized modification. | ||
| MITRE ATT&CK | T1071.004 — Application Layer Protocol: DNS | DNS is a common channel for command-and-control and covert activity. |
| Recommendation — Map suspicious DNS traffic to T1071.004 and hunt for C2 or tunnelling behavior. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | DNS abuse often follows compromise of credentials or secrets used to manage records. |
| Recommendation — Rotate exposed credentials and DNS-management secrets after suspected record abuse. | ||
Practitioner Guidance
What to verify: Confirm that critical domains, registrar accounts, zone-transfer settings, and authoritative records have clear ownership and change approval. If you cannot explain who can alter a record and how that change is reviewed, the control is incomplete.
What to measure: Track resolver baselines for rare domains, high-entropy subdomains, unusual query bursts, and unexpected shifts in TTL or response patterns. Pair that with monitoring for unauthorized record edits and delegation changes so you can distinguish normal change from abuse.
Practitioner takeaway: DNS should be treated as an actively monitored security control, not passive infrastructure, because the same mechanism that routes legitimate traffic can also steer defenders away from early warning signs.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org