.png)
What is DNS Security?
DNS security protects against DNS hijacking, tunneling, and malware communication. Learn how protective DNS, DNSSEC, and DNS monitoring defend against the 91% of malware that uses DNS to communicate.
The DNS Attack Surface
DNS is a critical attack surface because it is almost universally permitted through firewalls — blocking DNS would prevent internet connectivity entirely. This universal permission makes DNS an attractive channel for attackers who need to communicate with compromised systems (C2 via DNS tunneling), exfiltrate data (encoding data in DNS queries), or redirect victims to malicious infrastructure (DNS spoofing and cache poisoning).
DNS Tunneling
DNS tunneling encodes data within DNS query and response records, using the DNS protocol as a data channel that bypasses network security controls that block or monitor other protocols. Malware using DNS tunneling for command and control communications appears to generate legitimate DNS traffic to monitoring tools that do not perform deep DNS inspection. Tools like iodine and DNScat implement DNS tunneling for both legitimate and malicious purposes.
DNS Hijacking
DNS hijacking modifies DNS records to redirect users from legitimate destinations to attacker-controlled infrastructure. BGP hijacking redirects internet routing to attacker-controlled systems. DNS cache poisoning injects malicious DNS responses into resolver caches, causing clients querying those resolvers to receive incorrect IP addresses. DNSSEC — DNS Security Extensions — provides cryptographic authentication of DNS records, preventing cache poisoning attacks.
Protective DNS
Protective DNS services — Cisco Umbrella, Cloudflare Gateway, Quad9 — filter DNS resolution requests against threat intelligence databases, blocking access to known malicious domains at the DNS layer. When a user's device attempts to resolve a known C2 domain, protective DNS returns a blocked response rather than the attacker's IP address, preventing the connection before it reaches the network. DNS filtering is one of the most cost-effective security controls available because it provides broad coverage for a wide range of threats at minimal operational complexity.
DNS Security Monitoring
DNS logging captures every domain resolution attempted across the environment, providing a forensic record of what external resources systems were attempting to reach. DNS anomaly detection identifies patterns associated with malicious activity: high-frequency resolution of newly registered domains, resolution of domains with high entropy names (characteristic of domain generation algorithms), DNS query volumes inconsistent with normal operation, and resolution of domains appearing on threat intelligence blocklists. For many organizations, DNS logs are the most underutilized security data source available.
Real-World Example: Protective DNS Blocks Ransomware C2 Communication
A Cloudskope MDR client's network attempted DNS resolution of a known REvil ransomware C2 domain following what appeared to be a phishing link click on an employee workstation. Protective DNS returned a blocked response, preventing the ransomware payload from receiving its activation key and encryption configuration from the C2 server. The ransomware had been downloaded but could not complete its attack without C2 communication. The incident was contained within four minutes of the initial DNS block alert, before encryption occurred.
Of malware uses DNS to communicate — either for C2 communications, data exfiltration, or to locate attacker infrastructure. Protective DNS monitoring provides coverage against the majority of malware communication regardless of the specific malware family.