It can serve as an enforcement point for enterprise security policy and an indicator of potential malicious activity on a network. A disruption or attack against the DNS can impact an entire organization.
To that end, National Institute of Standards and Technology (NIST) updated its guidance for the Domain Name System (DNS) security. The document entitled the “Secure Domain Name System (DNS) Deployment Guide” last received an update in 2013.
In the document, NIST said “since the previous version was published, the ways in which DNS is used and deployed have changed significantly, and this revision provides an updated set of discussions and recommendations for securing modern DNS deployments.”
Special Publication (SP) 800-81r3 (Revision 3), Secure Domain Name System (DNS) Deployment Guide, describes the different roles of DNS and gives recommendations for protecting the integrity, availability, and confidentiality of DNS services, including:
- The role DNS plays in supporting a zero trust architecture, such as serving as a policy enforcement point (PEP) and a source of information when evaluating access requests
- The role of hosting DNS information (authoritative DNS), including guidance on protecting the integrity and authenticity of DNS information using DNSSEC
- The role of recursive DNS, including guidance on protecting the confidentiality of client DNS queries
This final version contains additional clarification on guidance based on feedback received during the public comment period. This includes additional text on minimizing information leakage in DNS queries and responses.