DNS: From internet utility to cornerstone of cybersecurity

Headlines continue apace with stories of cyberattacks — rising in frequency, sophistication, and cost. Wire fraud, executive spoofing, gift card scams, fake W2 or invoicing requests…the list grows endlessly. Yet most coverage misses a critical commonality: Virtually every attack begins with impersonation, be it of the site, email, credentials or entity. Modern cybercriminals rarely attack directly; instead, they masquerade as a trusted party, website or person. Whether posing as your CEO, your bank or a legitimate vendor, deception through impersonation has become a universal entry point for cyber fraud.

The premise, therefore, is that if we can establish that the site, email, person or entity is not who or what they claim to be, we can eliminate the vast majority of these threats before they gain traction. Simply put, upfront authentication isn’t just a technical safeguard; it’s a critical layer to neutralizing today’s most prevalent cyberattacks.

Establishing authenticity to start, therefore, enables the recipient to know whether further interaction, sharing or distributing of information is merited and safe. While organizations invest heavily in sophisticated cybersecurity, one system capable of providing verifiable, tamper-resistant truth about digital identity already exists within the internet’s foundational infrastructure: the Domain Name System. DNS is a system that most organizations use for basic connectivity but might overlook for the security capabilities it has evolved to provide.

From phone book to security foundation

In the classic view, DNS, often referred to as the “phone book” of the internet, resolves human-readable internet domain names into IP addresses. Akin to the power grid, DNS is a fundamental part of how systems on the internet route traffic, emails, data and other digital communications from sender to recipient.

There is another way to view DNS, one that is a powerful asset in our quest to tamp down crime: DNS is seen as a secure, globally distributed database. Since (in theory) only the owner of a domain’s DNS has write access and everyone has read access, viewing DNS as a way to set up instructions on who/what to interact with and what is permitted can be very powerful. DNS can, in essence, be viewed as a trusted “source of truth” at the very foundational layer of the internet. That’s why DNS perfectly fits the bill. DNS records can serve as a layer of transparency to indicate an organization’s security policy, and are a powerful mechanism proving useful in ways completely detached from their original intent.

When organizations recognize this potential, the results can be transformative. OpenDNS, which Cisco acquired for $635 million in 2015, exemplifies this evolution. What started as a “404 page” referral ad-supported company transformed when it recognized DNS’s potential as a secure, distributed database. By leveraging DNS for security intelligence rather than just routing, OpenDNS fundamentally transformed cybersecurity by pioneering the concept of DNS-as-a-security-layer, proving that the internet’s foundational naming system could serve as a powerful first line of defense against cyber threats.

Applying DNS-based authentication

As we look to build trust, organizations can leverage DNS-based protocols as a “source of truth” and bolster their security posture across the entire infrastructure in the process. Just like our power grid, we must fortify the internet’s foundation as new services or threats come online.

Security technologies like Domain Name System Security Extensions (DNSSEC) work like a digital signature for internet addresses and ensure that when your systems look up a website or service, they get the authentic answer, not a fake one created by attackers.

DNS can serve as a central policy repository for security rules. DNS-based systems like DMARC, which serve as an additional layer of defense to block domain-level impersonation, and BIMI, which authenticates brand logos, are examples of governing systems that aim to ensure valid and verified authentication of activity across your IT infrastructure. TLS, a security protocol that encrypts DNS queries, is used to prevent eavesdropping and enable private browsing. TLS prevents non-encrypted DNS web traffic from being redirected to malicious sites. In practice, these lines of defense answer the fundamental question of who is allowed to talk to your system and under what circumstances.

DNS-based Authentication of Named Entities (DANE) addresses fundamental key management challenges and the critical question of “who’s on top” of the trust hierarchy. Rather than relying on dozens of certificate authorities that browsers trust by default, the cryptographic foundation DANE provides allows domain owners to specify exactly which certificates should be trusted, and to store those certified keys in their DNS. In short, DANE transforms DNS from a basic directory service into a trusted foundation for digital operations.

These capabilities translate into practical applications across the entire security stack. At the foundational level, Certificate Authority Authorization prevents unauthorized certificate issuance by specifying which authorities can issue certificates for your domains, blocking malicious certificates before they’re created. Building on this foundation, Software Supply Chain Verification extends the same trust principles to allow automated integrity assessment before new software is installed.

For operational security, API and Service Authentication leverage DNS for service discovery, providing location and authentication requirements dynamically, while Network Access Control takes this further by publishing device authorization policies that enable zero-trust architectures where device identity is cryptographically verified before network access. When incidents do occur, Response Coordination standardizes security procedures in DNS records, enabling automated discovery of proper escalation protocols during security incidents.

The business case for DNS-based security

Beyond technical elegance, DNS-based security creates a cascading value proposition that transforms how organizations approach cybersecurity economics. A DNS-based approach provides a horizontal protective layer across entire categories of attacks.

Moreover, by consolidating authentication policies into DNS records, organizations replace fragmented security systems with unified governance, creating clear oversight. This consolidation becomes especially valuable as regulatory frameworks increasingly demand auditable, cryptographically-verifiable security policies — exactly the capabilities that DNS protocols naturally satisfy.

Perhaps most significantly, this approach scales without architectural disruption. As cloud-native systems, IoT devices and AI platforms proliferate, DNS-based authentication provides a foundation that grows with infrastructure demands rather than creating new integration challenges. Organizations investing in DNS security today aren’t just solving current problems; they’re building competitive advantages for tomorrow’s security landscape, where existing DNS investments can cover multiple security domains while reducing total cost of ownership.

Building zero-trust architecture with DNS

As organizations embrace DNS as a foundational security measure, they must also acknowledge its growing strategic importance and vulnerability. The same global infrastructure that makes DNS so powerful for security also makes it an attractive target for sophisticated adversaries. We’ve witnessed how geopolitical tensions threaten internet stability, and how nation-state actors target DNS precisely because disrupting it can cripple organizations worldwide. Meanwhile, cloud providers are empowering tech companies to make DNS decisions that can affect global internet access. This has proven detrimental in high-stakes situations, like the war in Ukraine.

With long-standing principles of internet governance at play, organizations need a foundational framework for building secure, scalable digital systems in a zero-trust world.

DNS mastery becomes a force multiplier in zero-trust environments. Organizations that develop sophisticated DNS security capabilities can apply those skills across their entire digital infrastructure, creating comprehensive security architectures that are both more effective and efficient than point solutions.

The path forward

As digital transformation accelerates and traditional network perimeters dissolve, organizations need new ways to establish trust where users, devices and services can securely connect from anywhere.

Organizations that recognize DNS as a strategic asset rather than a utility service will thrive in the next era of cybersecurity. By investing in DNS security capabilities today, they position themselves to leverage emerging standards while building more resilient architectures.

The internet’s phone book has evolved into a global system for establishing digital truth. The question isn’t whether organizations will need to master DNS-based security; it’s whether they’ll do so proactively or reactively. In cybersecurity, as in business, timing matters.

Disclaimer: Valimail holds numerous patents in the DNS authentication space.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?