What Is DNS and Why It Matters for Security

Every time you type a domain name into your browser, your computer has to translate that name into an IP address before it can connect. The Domain Name System (DNS) is the distributed database that handles this translation. It is one of the oldest and most fundamental parts of the internet's infrastructure.

It is also one of the most frequently abused.

How DNS Works

When you navigate to example.com, your device checks its local cache first. If the record is not cached, it asks your configured DNS resolver -- usually your ISP's server or a public resolver like 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare).

The resolver works through a hierarchy:

1. It asks a root nameserver: 'Who is responsible for .com?'
2. The root nameserver points to the .com nameservers.
3. The resolver asks the .com nameservers: 'Who is responsible for example.com?'
4. They point to example.com's own nameservers.
5. The resolver asks example.com's nameservers for the A record (IP address).
6. The resolver returns the IP address to your device and caches it for the TTL duration.

This entire process typically takes 20-120 milliseconds.

DNS Record Types and What They Do

A record: Maps a domain to an IPv4 address. This is the most common type.

AAAA record: Maps a domain to an IPv6 address.

MX record: Specifies the mail servers for a domain. Email routing depends entirely on MX records.

TXT record: Stores arbitrary text. Used for SPF, DKIM, DMARC email authentication, and domain ownership verification.

CNAME record: An alias pointing one domain to another. www.example.com might CNAME to example.com.

NS record: Lists the nameservers responsible for the domain.

You can query all of these with the DNS Lookup tool on this site.

How Attackers Abuse DNS

DNS hijacking: An attacker compromises your router, DNS resolver, or domain registrar account and changes DNS records to point your domain to their server. Visitors think they are on your site while actually submitting data to the attacker.

DNS spoofing / cache poisoning: An attacker injects false DNS records into a resolver's cache. Anyone using that resolver gets directed to the wrong IP address without any change to your actual DNS records.

DNS tunneling: Attackers encode data in DNS queries and responses to exfiltrate information or communicate with malware past firewalls. Many firewalls allow DNS traffic but do not inspect it closely. DNS tunneling exploits this oversight.

Subdomain takeover: When a CNAME record points to a service (like Heroku or GitHub Pages) that has been deprovisioned, an attacker can claim that service and serve content from your subdomain. This is why auditing DNS records when decommissioning services matters.

Domain shadowing: Attackers who compromise a domain registrar account create subdomains used as attack infrastructure, often going unnoticed because the main domain is legitimate.

Protecting Your DNS Configuration

Enable DNSSEC on your domain to cryptographically sign DNS records. Resolvers can verify that records have not been tampered with in transit.

Lock your domain at the registrar level. Most registrars offer a transfer lock that prevents unauthorized domain transfers. For critical domains, registry lock (arranged through your registrar) provides an additional layer.

Audit your DNS records regularly. Old CNAME records pointing to deprovisioned services are a common source of subdomain takeover vulnerabilities. Use the Subdomain Finder tool on this site to see what DNS records exist for your domain.

Monitor for unauthorized changes. Set up alerts for changes to your domain's DNS records. Most registrars and DNS providers offer change notification emails.

Use a reputable DNS provider. Cloudflare, Google Cloud DNS, and AWS Route 53 have stronger security practices than budget registrars that bundle DNS hosting.