The Domain Name System (DNS) is the internet’s distributed naming system that translates human-readable domain names such as example.com into IP addresses that computers use to connect.
How DNS works
DNS was designed by Paul Mockapetris in 1983 and is specified in RFC 1034 and 1035. When a user opens a website, the device asks a recursive resolver (usually run by the ISP, the company or a public service). The resolver queries the hierarchy – root servers, then top-level domain servers such as .com, then the domain’s authoritative name servers – and caches the answer for the time set in its TTL. Common record types include A and AAAA (IPv4/IPv6 addresses), MX (mail servers), CNAME (aliases), NS and TXT (used for SPF, DKIM and DMARC). Classic DNS runs over UDP and TCP port 53 without encryption.
Why DNS matters for security
Almost every connection begins with a DNS lookup, so controlling DNS means controlling where users end up:
- DNS cache poisoning – forged answers stored by resolvers; Dan Kaminsky’s 2008 discovery showed how practical this was.
- DNS hijacking – changing records or resolver settings; the Sea Turtle campaign, reported in 2019, redirected government and company domains this way.
- DNS tunnelling – malware hides command-and-control traffic and data theft inside DNS queries (MITRE ATT&CK T1071.004).
- DDoS – the 2016 DDoS attack by the Mirai botnet on DNS provider Dyn made major websites unreachable; open resolvers are also abused for amplification.
How to protect DNS
- Sign zones and validate answers with DNSSEC (RFC 4033–4035).
- Lock domains at the registrar and protect registrar accounts with MFA.
- Log and analyse DNS queries to detect tunnelling and malicious domains, and use protective DNS filtering.
- Encrypt queries with DNS over TLS or DNS over HTTPS where appropriate.
