The Domain Name System is the address book of the internet: it resolves names to addresses for nearly every connection an organisation makes. That ubiquity makes it a target, a transport for attacks, and — handled correctly — one of the highest-value sources of security telemetry.
Why attackers abuse DNS
DNS is rarely blocked and rarely inspected. Most networks must allow it for basic function, which makes it a reliable channel for command-and-control: malware resolves attacker-controlled domains to receive instructions, and detection based on IP blocking alone misses it entirely.
Tunnelling takes this further: data is encoded in DNS queries and responses, allowing exfiltration or covert command channels over a protocol designed for simple lookups. A resolver sees the query stream; without analytics, tunnelling looks like noise.
Attackers also use DNS for redirection and evasion: domain generation algorithms produce thousands of candidate domains, fast-flux rotates addresses, and newly registered or reputation-poor domains host phishing and malware delivery.
The controls that work
Protective DNS filtering blocks resolution of known-malicious and policy-inappropriate domains at the resolver. This stops a large class of commodity attacks — malware delivery, phishing infrastructure, tracker abuse — before a connection is ever established.
DNS monitoring and analytics detect what filtering misses: high-volume query patterns characteristic of tunnelling, algorithmically generated domain names, resolution of newly registered domains from sensitive segments, and unusual DNS activity from servers that should never query external names.
Data protection and visibility matter too: enforcing encrypted transport for DNS where appropriate, logging queries with the context needed for investigation, and correlating DNS telemetry with network and endpoint signals.
Where DNS fits in detection architecture
DNS telemetry is among the most valuable feeds for Network Detection and Response: it is compact, high-coverage and difficult for attackers to avoid. Correlated with threat intelligence indicators, it supports both detection and hunting — a blocklist of active malicious domains is only useful if resolution attempts are logged and alerted.
At the architecture level, DNS control belongs in network security alongside segmentation and boundary controls. It is one of the few controls that delivers immediate value at minimal operational cost: a resolver policy change can neutralise an entire campaign against every device on the network, including the ones that cannot run an agent.
A practical starting point
Inventory your DNS paths: which resolvers serve which segments, and what leaves the network. Enforce protective filtering with logging on every path — including remote users and cloud workloads, where DNS often escapes policy.
Then build the detection layer: baseline normal query behaviour, alert on tunnelling indicators and new-domain resolution from sensitive systems, and feed confirmed malicious domains into blocking automatically. Review what was blocked monthly; the blocked traffic is a map of what is trying to reach your organisation.