For many years, DNS was mainly seen as a basic networking service: a way to translate domain names into IP addresses. But the latest NIST SP 800-81r3 Secure DNS Deployment Guide makes it clear that DNS should now be treated as a critical part of the security architecture.
Why? Because almost every internet connection starts with DNS.
Before a user visits a website, before an application connects to a cloud service, and before malware reaches out to command-and-control infrastructure, a DNS request usually happens first. That makes DNS one of the earliest and most effective places to detect, block, and investigate suspicious activity.
Protective DNS as a Security Control
NIST highlights the importance of Protective DNS as part of a modern defence-in-depth and zero trust strategy. Protective DNS can help reduce exposure to phishing, malware, ransomware, and command-and-control traffic by applying security policy at the point of domain resolution.
In simple terms, if a user or device tries to connect to a known malicious domain, Protective DNS can block that connection before the session is established. This reduces risk before the threat reaches the endpoint.
DNS Logs Matter
DNS is also a valuable source of security telemetry. DNS logs can show which devices attempted to access suspicious domains, when those requests happened, and whether they were blocked or allowed.
For SOC teams, this data is extremely useful for investigations, threat hunting, and correlation with endpoint, firewall, identity, and SIEM events. DNS visibility can help answer important questions such as:
- Was this device attempting to contact known malware infrastructure?
- Did multiple users try to access the same phishing domain?
- Is there evidence of command-and-control activity?
- Is a device making unusual DNS requests that could indicate compromise?
Encrypted DNS: Privacy vs Visibility
Encrypted DNS protocols such as DNS over HTTPS and DNS over TLS provide important privacy benefits by helping protect DNS queries from interception. However, if they are not properly managed, they can also create blind spots and allow users, browsers, applications, or malware to bypass approved DNS resolvers.
This creates a security challenge. Organisations should not allow any application to use any external encrypted DNS provider by default. Instead, they should define which DNS resolvers are approved, ensure DNS requests are filtered and logged, and prevent DNS from becoming a way to bypass corporate security policy.
Resilient DNS Is Critical
NIST also reinforces that DNS infrastructure must be resilient, highly available, monitored, and separated from unnecessary services. DNS is mission-critical. If DNS fails, users may lose access to applications, cloud services, and business systems.
That means DNS should be treated like other critical infrastructure: hardened, monitored, protected from misuse, and designed for availability.
Where OpenText Core DNS Protection Fits
OpenText Core DNS Protection aligns strongly with this guidance by helping organisations turn DNS into an active security layer.
It leverages OpenText Threat Intelligence, formerly BrightCloud, to deliver accurate, real-time domain and web classification based on massive global telemetry. By using machine learning, AI-driven analysis, reputation scoring, and data gathered from millions of endpoints, networks, and sensors, OpenText Core DNS Protection can identify risky destinations quickly while helping reduce false positives. This matters because DNS security is only effective when it blocks genuinely malicious activity without disrupting legitimate business access.
The service is hosted on Google Cloud, providing a resilient, scalable, and globally available DNS security platform designed for performance and reliability. This is important because DNS security controls must be fast and dependable; if DNS protection slows users down or becomes unavailable, it can quickly impact the business.
One of the most important capabilities within OpenText Core DNS Protection is DNS Leak Prevention. A DNS leak occurs when DNS resolution is performed by an unknown or unauthorized source, allowing users, applications, VPNs, or malware to bypass approved DNS resolvers. This can result in missed filtering, reduced logging, weaker visibility, and increased risk of command-and-control communication, malware activity, or DNS-based data exfiltration.
When enabled, DNS Leak Prevention helps administrators enforce DNS control across the main resolution paths: standard DNS over port 53, DNS over TLS on port 853, and DNS over HTTPS over port 443. This is especially important as more browsers, applications, and malware families attempt to use embedded resolvers or encrypted DNS providers outside of corporate policy. By blocking unauthorized DNS resolution channels, DNS Leak Prevention helps ensure that DNS requests remain managed, filtered, logged, and reportable through OpenText Core DNS Protection.
This aligns closely with NIST guidance around restricting unauthorized public DNS providers, controlling encrypted DNS protocols, and preventing DNS from becoming a bypass route around security policy. From a security operations perspective, this preserves critical visibility for SOC investigations, supports policy enforcement, and helps ensure that the privacy benefits of encrypted DNS do not come at the cost of reduced control or detection capability.
Final Thought
DNS is no longer just a background networking service. It is a security control, a visibility source, and a policy enforcement point.
The message from NIST is clear: organizations should secure DNS, monitor DNS, protect DNS infrastructure, and prevent unmanaged DNS bypass. OpenText Core DNS Protection supports this approach by combining accurate threat intelligence, resilient cloud-based DNS security, and strong control over modern DNS protocols, including DoH and DoT.
In today’s threat landscape, securing DNS is not optional. It is a foundational part of cyber resilience.