Protective DNS vs. DNS Posture Management: Two Layers, One Discipline
NIST SP 800-81r3 reframed DNS as an active security control, and NIS2 brought 180,000 organizations into scope. Two terms get confused in the response: Protective DNS and DNS posture management. They protect different things in different directions, and a complete program needs both. Here is how they differ and fit together.
DNS Posture vs. ASM: Where They Overlap, Where They Don't
If you run an Attack Surface Management platform, there is a fair question to ask before considering DNS posture management: do I not already have this? ASM tools discover subdomains, after all. Here is a straight answer, the one place they genuinely overlap, and the several places they diverge.
The DNS Posture Gap Your CNAPP Doesn't Cover
A Cloud-Native Application Protection Platform consolidates cloud posture impressively, but one layer sits just outside its scope: your DNS and domain posture. Domains are public-facing, span every provider at once, and live outside any single cloud account. Here is why that gap exists and how DNS posture management fills it.
Email Deliverability Beyond SPF, DKIM, and DMARC
SPF, DKIM, and DMARC are the foundation of email authentication, but they are not the whole story. A newer layer, published largely through DNS, secures the connection between mail servers, reports when encryption fails, shows your verified logo in the inbox, and preserves authentication through forwarders. Here is what MTA-STS, TLS-RPT, BIMI, and ARC do.
DNS in Multi-Cloud and Hybrid Environments
Adopt a second cloud or keep one foot on-premises, and DNS stops being a single coherent thing. Each cloud brings its own DNS service and private zones, and none natively knows about the others. Here are the specific challenges of multi-cloud and hybrid DNS, the patterns that tame them, and why cross-provider visibility matters most.
Monitoring Glue Records and Delegation
Some of the most consequential DNS records are ones most people never touch and few think to monitor. Glue records and delegation live in the parent zone, not yours, and when they break, the failure is often total and confusing, because the problem is not in the zone you administer. Here is how they work and what to watch.
Building DNS Runbooks and On-Call Playbooks
It is 2 a.m., alerts are firing, and the person on call may not be your DNS expert. A good runbook turns a high-pressure judgment call into a checklist. Here is what makes a DNS runbook effective, plus adaptable playbook templates for hijacking, DNSSEC failure, propagation issues, and expiry emergencies.
Protecting Against Registrar Account Takeovers
If an attacker gains access to your registrar account, they do not need to find a misconfiguration, they can change your nameservers, transfer your domains, and redirect everything, because to the registrar, they are you. Here is how takeovers happen, how to harden your account, the signals of an attack, and a recovery playbook.
SVCB and HTTPS Records: A Practical Adoption Guide
Two newer DNS record types, SVCB and HTTPS, let a domain publish how a service should be reached, not just where, in a single lookup. That means faster connections, a clean fix for the apex CNAME problem, and a foundation for privacy features. Here is how they work and how to adopt them.
DNS Inventory as a Living Asset: Building a Complete Domain Catalog
Ask most organizations for a list of the domains they own and you get a spreadsheet that is confidently wrong, missing the subdomains, acquisitions, and forgotten records where risk concentrates. Here is how to build a DNS inventory that reflects reality rather than intention, and keep it current.
Domain Fronting and CDN Abuse: Hiding Traffic Behind Trusted Names
Domain fronting lets traffic claim one destination while reaching another, borrowing a trusted CDN's reputation to slip past filters. It has been used both to circumvent censorship and to hide malicious command-and-control. Here is how it works and why it is so hard to detect.
Hotel Wi-Fi DNS Poisoning: How APT28-Style Tradecraft Steals Microsoft 365 Logins
In July 2026, ReliaQuest documented a campaign compromising hotel Wi-Fi gateways to poison DNS and harvest Microsoft 365 credentials from traveling employees, with tradecraft echoing Russia's APT28. Here is how the attack works, why common DNS protections do not stop it, and what does
Preparing Your DNS for NIS2 and DORA
NIS2 and DORA rarely mention DNS by name, which leads many teams to assume it falls outside scope. In practice DNS underpins four things both regulations care about: asset inventory, supply chain dependency, incident detection, and continuity. Here is how to prepare.
Integrating DNS Monitoring With Your SIEM (Splunk, Elastic, Sentinel)
Your SIEM correlates endpoint, identity, and network telemetry, but DNS is usually missing from the picture. Here's why DNS events belong in your SIEM, which signals are worth ingesting, the two integration patterns, and what the work actually involves.
Zero Trust DNS: Applying "Never Trust, Always Verify" to Your Domains
Zero Trust reshaped how we think about network access and identity, but one critical layer gets left out of the conversation: DNS. Here's what "never trust, always verify" means for your domains, why DNS belongs in any Zero Trust strategy, and how to put the principles into practice.
Building a DNS Audit Checklist for Quarterly Reviews (With Free Template)
Most DNS problems are not caused by attacks. They are caused by drift: records for projects that ended, SPF entries for vendors you dropped, subdomains pointing at deleted resources. Here is a repeatable six-part quarterly audit checklist, plus a free downloadable template.
What Is DNS Posture Management (DNSPM)? The Complete Guide
DNS Posture Management (DNSPM) is the discipline of continuously monitoring and securing your entire DNS footprint, not just its uptime. Learn what DNSPM covers, why it matters, and how to implement it across your domains.
How to Choose a DNS Monitoring Tool: What Actually Matters
Everyone claims to do DNS monitoring, and almost no two products mean the same thing by it. This vendor-neutral buyer's guide covers the three jobs DNS tools actually do, the eight questions that separate a real fit from a costly mismatch, and the tradeoffs nobody puts on their homepage.
Building a Continuous DNS Compliance Program (SOC 2, ISO 27001, NIS2 & PCI-DSS Ready)
Turn DNS from an audit liability into a compliance strength. A practical framework for meeting SOC 2, ISO 27001, NIS2, and PCI-DSS expectations through continuous monitoring instead of last-minute scrambles, with a free governance framework PDF included.
Shadow DNS: The Subdomains Your Team Forgot Exist
Marketing spins up a campaign subdomain pointing at a third-party tool. The campaign ends, the tool is deprovisioned, but the DNS record lives on. That's shadow DNS: records created outside governance that become an attack surface nobody is watching. Here's how it forms and how to control it.
DNS Governance During Mergers and Acquisitions
When an acquisition closes, you inherit the target's entire DNS footprint: undocumented domains, dangling records, expiring registrations, and email authentication that has to keep working through the transition. Most of it is invisible, and now it's your risk. Here's how to govern DNS through M&A.
GHOST STADIUM: How 4,300 Fake Domains Targeted the FIFA World Cup 2026
Months before the 2026 FIFA World Cup, security researchers uncovered GHOST STADIUM: a phishing operation spanning 300+ domains, part of an ecosystem of over 4,300 fraudulent FIFA lookalikes. Here's how the campaign was built on the DNS layer, and what the warning signs look like.
DNS Rebinding and NXDOMAIN Hijacking: Two Overlooked DNS Attacks
Some DNS attacks don't change your records at all. DNS rebinding turns a victim's browser into a tool for reaching internal networks, and NXDOMAIN hijacking exploits "does not exist" responses. Here's how both work and what defends against them.
How to Read DNS Lookup Output (dig, nslookup, and What It All Means)
Running a DNS lookup produces a wall of text most people ignore. But the status codes, flags, TTLs, and section structure are full of diagnostic signal. Here's how to read dig and nslookup output line by line, and what each part tells you.
How to Point Your Domain to a New Server
Moving to a new server means updating one DNS record, but the details determine whether it's a smooth cutover or hours of partial downtime. Here's how to point your domain to a new server with zero downtime and nothing left behind.
Multi-Provider DNS: Why and How to Use Secondary DNS
When the 2016 Dyn attack took down half the internet, sites with a second DNS provider stayed up. Multi-provider DNS removes your single point of failure. Here's how primary-secondary and multi-primary models work, the DNSSEC complications, and how to set it up.
DNS Disaster Recovery: Building a Resilient DNS Strategy
When DNS fails, everything fails. Yet DNS is often the least planned-for dependency in disaster recovery. Here are the failure modes that take DNS down, the architecture that makes it resilient, and the practices that let you recover fast.
Anycast vs Unicast DNS: Why It Matters for Performance
With unicast, one IP maps to one server. With anycast, one IP is served from hundreds of locations, and the network routes each query to the nearest one. That difference shapes DNS latency, failover, and DDoS resilience worldwide.
Wildcard DNS Records: Uses, Risks, and Best Practices
A single wildcard record answers for unlimited subdomains. Powerful for multi-tenant SaaS, dangerous when forgotten. Here's how wildcard matching actually works, the security risks they introduce, and best practices for using them safely.
What Is a Zone File? Understanding DNS Zone Structure
A zone file is the text-based blueprint behind every domain's DNS. Here's a line-by-line walkthrough of its structure: the SOA record, serial numbers, NS records, resource records, and the trailing-dot rule that causes the most common zone file errors.
163 Brands Hijacked via Abandoned DNS: The Borrowed Trust Attack
163 organizations across 30+ countries had gambling content served under their own trusted domains, some for over six years, with no security alert firing. The Borrowed Trust campaign is dangling DNS exploited at industrial scale. Here's how it worked and how DNS monitoring stops it.
DNS over HTTPS (DoH) vs DNS over TLS (DoT): What's the Difference?
Both DoH and DoT encrypt your DNS queries, but one hides in web traffic on port 443 while the other uses a dedicated port 853. The difference comes down to a tension between individual privacy and network control.
How to Set Up a Subdomain: A Complete Guide
A subdomain is just a DNS record under your existing domain, with no separate registration or extra cost. Here's how to set one up with A records or CNAMEs, step by step, plus the common reasons subdomains don't work right away.
How to Migrate DNS to a New Provider Without Downtime
DNS migration sounds risky, but with the right sequence, users never notice. Here's the complete zero-downtime playbook: preparation, setting up the new provider, the cutover, and verification, phase by phase.
DNS Cache Poisoning Explained (and How DNSSEC Stops It)
DNS cache poisoning injects a false answer into a resolver's cache, silently redirecting everyone who uses it to a malicious server. Here's how the attack works, the famous Kaminsky vulnerability, and how DNSSEC stops it.
What Is an Authoritative vs Recursive DNS Server?
One type of DNS server holds the answer, the other knows how to find it. Understanding the difference between authoritative and recursive DNS explains caching, propagation delays, and why certain attacks target one over the other.
What Is a DNS Amplification DDoS Attack?
A single attacker can generate hundreds of gigabits of attack traffic by tricking DNS servers into reflecting amplified responses at a victim. Here's how DNS amplification works, why DNS is ideal for it, and how to avoid being a victim or an unwitting reflector.
DNS Tunneling: How Attackers Exfiltrate Data Through DNS
DNS is the one protocol networks can't block, which makes it a covert channel for data theft and command-and-control. Here's how DNS tunneling works, why it's so effective, and how to detect and defend against it.
A Record vs CNAME: When to Use Each
An A record points to an IP, a CNAME points to another domain name. The distinction affects your apex domain, email, and SSL certificates. Here's exactly when to use each, the rules you can't break, and common mistakes.
Self-Hosted vs. Managed DNS: Pros, Cons, and Security Implications
Full control with zero third-party dependency, or global performance with automated DNSSEC? A practical comparison of self-hosted and managed DNS across reliability, security, performance, control, cost, and operational complexity.
DNS for Microsoft 365: Every Record You Need and Why
Microsoft 365 requires 6-8 DNS records for email, autodiscover, authentication, and federation. Here's every record with exact values, the DKIM two-step activation trap, the July 2026 MX migration, and a verification checklist.
DNS TTL Best Practices: How to Choose the Right Values
TTL controls how fast DNS changes propagate, how resilient your domain is during outages, and how much load your nameservers handle. Here are recommended values for every record type, the pre-migration process, and common mistakes.
Post-Quantum Cryptography and DNS: What's Changing and How to Prepare
NIST is deprecating RSA and ECDSA by 2030. Here's what that means for DNSSEC, DKIM, and TLS, why DNS migration is uniquely challenging due to signature sizes, and what organizations should be doing now to prepare for the 10-year transition.
Understanding Reverse DNS (PTR Records) and Why Email Deliverability Depends on It
Gmail rejects email from IPs without PTR records. Here's what reverse DNS is, how the three-way match between PTR, A record, and HELO hostname works, how to set it up with major cloud providers, and common pitfalls.
Domain Expiration: The Silent Risk That Takes Down Businesses
Microsoft lost hotmail.co.uk. Dell lost a backup domain. An expired credit card, a departed employee, a missed renewal email — and your domain belongs to someone else. Here's how domain expiration happens and how to prevent it.
CAA Records: The DNS Security Control Most Organizations Skip
Without CAA records, any of hundreds of Certificate Authorities can issue a TLS certificate for your domain. Two minutes of DNS configuration restricts issuance to only the CAs you authorize. Here's how to set it up.
DNS Monitoring vs. Uptime Monitoring: Why You Need Both
Your server can be running perfectly while your domain is unreachable. Uptime monitoring checks servers. DNS monitoring checks resolution, records, DNSSEC, email auth, and WHOIS. Here are 7 real scenarios where uptime monitoring shows green while DNS is broken.
What Is DNSSEC and Should You Enable It?
DNSSEC adds cryptographic signatures to DNS, preventing cache poisoning and response forgery. Here's how the chain of trust works, how to enable it with major providers, key rollover pitfalls, and why monitoring is the difference between protection and outage.
DNS Is Becoming the Discovery Layer for AI Agents: What DNS-AID Means for Your Infrastructure
DNS-AID, an IETF specification, proposes using SVCB records to let AI agents discover each other via DNS. Here's how it works, what risks it introduces, and why DNS monitoring becomes AI agent security monitoring.
Dangling DNS Records: The Hidden Attack Surface in Your Infrastructure
Forgotten DNS records pointing to decommissioned cloud services let attackers hijack your subdomains. With real incidents at Microsoft, the CDC, and Fortune 500 companies, here's how subdomain takeovers work and how to detect dangling records before attackers do.
How to Diagnose DNS Issues: A Troubleshooting Guide
"It's always DNS" — here's how to prove it. A systematic guide to diagnosing NXDOMAIN errors, SERVFAIL responses, email delivery failures, certificate issues, and intermittent resolution problems.
SPF, DKIM, and DMARC Explained: The Complete Email Authentication Guide
Three DNS protocols protect your domain from email spoofing: SPF, DKIM, and DMARC. Here's how each works, how they fit together, the most common misconfigurations, and how to check your setup.
What Is DNS Propagation and Why Does It Take So Long?
DNS propagation isn't a broadcast. It's thousands of independent caches expiring at different times. Here's how it actually works, why the "24-48 hours" advice is usually wrong, and how to plan changes that propagate in minutes.
The Underminr Vulnerability: When a Clean Domain Hides an Attack
The Underminr vulnerability exploits shared CDN infrastructure to hide malicious connections behind trusted domains. With 88 million domains potentially exposed, here's what domain owners need to know and how DNS monitoring provides visibility.
When DNS TXT Records Become a Backdoor: Lessons from a Go Supply Chain Attack
A typosquatted Go library used DNS TXT records as a covert command and control channel for 33 months. Here's how DNS becomes an attack surface and why TXT record monitoring matters.
How a Routine Key Rollover Took Down Germany's Internet: The .de DNSSEC Outage
On May 5, 2026, a routine DNSSEC key rollover at DENIC broke millions of .de domains for hours. Here's what happened, why traditional monitoring missed it, and how DNS-specific monitoring detects these incidents in minutes.
Someone Could Be Using Your Domain Right Now (And You Would Not Know)
8,000+ trusted domains hijacked to send 5 million fake emails daily. $500K stolen in 47 minutes through a DNS record change. The CDC's own subdomains serving scam content for weeks. None of these organizations were monitoring their DNS records. Here is why you should be.
WHOIS Data Changes: What They Mean and Why You Should Care
Every domain has a registration record containing its registrar, expiration date, nameservers, and contact information. When those fields change unexpectedly, it can signal an unauthorized transfer, an impending expiration nobody noticed, or the opening move of a domain hijacking attack. Here's what to watch and why it matters.
CoW Swap DNS Hijacking: What Went Wrong and How Monitoring Could Have Helped
Detecting DNS Hijacking: Real-World Attack Patterns
DNS hijacking is an active attack vector used by nation-state actors and organized cybercriminals. This technical breakdown examines five real-world attack patterns from APT28, Hazy Hawk, Sea Turtle, and Evasive Panda, with the specific DNS indicators each produces and how automated monitoring detects them.
Building a DNS Monitoring Strategy for Enterprise Teams
Most organizations monitor servers, apps, and networks with dedicated tooling, but DNS often falls into a gap between infrastructure and security teams with no single owner. Here's how to structure alert rules, escalation policies, and team responsibilities for organizations managing thousands of domains.
Why DNSSEC Matters More Than Ever
DNS hijacking attacks are on the rise. Learn how DNSSEC validation protects your domains and why monitoring the chain of trust is critical.
Understanding DNS Record Types: A Complete Guide
A comprehensive guide covering every DNS record type. What each does, when you need it, what can go wrong, and how proactive monitoring prevents problems before they become incidents.