DNS Security: DNSSEC, Common Misconfigurations and Domain Risks

DNS (Domain Name System) translates domain names into IP addresses — it is the internet’s “address book.” Despite being critical, it is often neglected, yet attacks on DNS have serious consequences, from redirecting users to fake sites to full domain takeover. This article covers the core topics of DNS security.

DNSSEC: integrity of responses

Classic DNS does not cryptographically guarantee the correctness of responses, which leaves room for attackers to inject forged DNS answers (DNS spoofing / cache poisoning). DNSSEC (DNS Security Extensions) signs DNS responses with digital signatures, letting a resolver verify that a response genuinely came from the authoritative server and was not altered.

• DNSSEC protects the integrity and origin of responses (not their confidentiality).
• It is configured at the domain and DNS-provider level; if misconfigured it can make a domain fail to resolve, so apply it carefully.

Dangling records and subdomain takeover

If a subdomain (e.g., blog.yoursite.com) still points to an external service you no longer use (a cloud resource, a hosting account), an attacker can create that service under their own control and take over your subdomain. The result: attacker content on your domain. The fix is to remove unused DNS records and regularly audit for dangling records.

Other DNS security records

• CAA: Restricts which certificate authorities may issue certificates for your domain (against unauthorised certificates).
• SPF/DKIM/DMARC: Email authentication; they live in DNS TXT records.
• Registrar account security: Compromise of your domain-management account means compromise of all your DNS; apply MFA and a registrar lock.

How to check

dig CAA yoursite.com
dig DNSKEY yoursite.com    # are DNSSEC keys present

Also list your subdomains and confirm each is genuinely in use, leaving no dangling records.

Summary

DNS, as the internet’s address book, is a frequent attack target. Core measures: DNSSEC for response integrity (applied carefully), cleaning up dangling records against subdomain takeover, CAA against unauthorised certificates, and protecting the domain-management account with MFA and a registrar lock. Treat DNS as a regularly audited asset, not “set and forget.”

Sources: ICANN: DNSSEC, RFC 8659 (CAA).

Are your domain’s DNS and certificate security records (CAA, dangling records, email records) complete? CyberTestify’s external surface scan checks them.