DNS Security
Everything EfficientIP publishes on protecting DNS: how the attacks work, what the controls do, and which products enforce them.
147 articles · 12 definitions · 21 reports and resources
What this topic covers
DNS is the first thing an attacker touches and the last thing most security programmes instrument. It resolves before the firewall inspects, it runs on ports nobody wants to close, and its logs are usually too voluminous to read and too valuable to discard. That combination is why data exfiltration, tunnelling, domain generation algorithms and volumetric floods all end up as DNS problems before they are recognised as anything else.
The writing collected here covers how specific DNS attacks work, what a DNS-layer control can and cannot do about them, and how those controls sit in a security stack that already has a firewall, an IPS and a SOC. Definitions sit beside the articles because the vocabulary is genuinely contested: protective DNS, recursive DNS and private DNS mean different things to different vendors.
Start here
Two pages answer most of it. The rest of this page is the detail.
Solution
Enterprise DNS security
What EfficientIP sells against this topic: filtering, behavioural threat detection and service continuity enforced at the resolver, before a connection is ever made.
Definition
What is DNS security?
The definition, written for someone who has to explain the control to a security review rather than configure it.
Everything on DNS security
Ordered by depth rather than by date. Foundations first, then the specific attacks and the controls that answer them.
Articles
Modern DNS architecture: foundations
Role separation, hidden primaries, resolver tiering and Anycast: the design decisions that make a hybrid DNS estate resilient before security is layered on.
Modern DNS architecture: design and operations
Traffic steering, multi-vendor control and integrated DNS security as one operating model, continuing where the foundations stop.
NIST’s DNS security roadmap for the enterprise
Read the NIST guidance as a sequence of decisions you can take to a security review, rather than as a document to summarise later.
Definitions
DNS
What resolution actually does, and why every control on this page depends on it.
DNS records
Which record types exist and what each one answers.
Recursive DNS
Where enterprise queries get answered, which is also where policy can be applied.
DNS attack
The families of attack that the rest of these definitions sit under.
Protective DNS
The term government security guidance uses for a resolver that checks a query before answering it.
Private DNS
What the term means, and what it is taken to mean by vendors who use it differently.
DNS filtering
How a resolver declines to answer for a domain, and what the client sees instead.
DNSSEC
What DNSSEC signs, and which attacks it leaves untouched.
DNS tunnelling
How a working channel is built inside queries that look ordinary.
Data exfiltration
What data leaving the network inside DNS traffic looks like in a query stream.
DNS amplification attack
How a small query becomes a large response aimed at somebody else.
DNS observability
What DNS logs can tell a SOC once somebody can read them at volume.
Reports and resources
Analyst report
GigaOm Radar for DNS Security 2026
GigaOm’s evaluation of the DNS security vendor set, and where EfficientIP places in it.
Solution brief
Modernizing DNS Architecture with SOLIDserver
How to move DNS onto SOLIDserver across hybrid and multicloud estates with resilience and security built into the architecture.
Datasheet
SOLIDserver DDI for DNS, DHCP and IPAM
The platform datasheet: what SOLIDserver delivers for DNS, DHCP and IPAM, including the DNS security capabilities that run on it.
Find out what your DNS is exposing
A DNS security audit looks at what your resolvers answer, what they log, and what leaves the network through them. Book one and see the findings against your own estate.