# What is DNS Security?

> DNS security protects the availability, integrity, authenticity, and appropriate confidentiality of the Domain Name System and uses DNS activity as a source of defensive context.

- Canonical URL: https://yellowcube.eu/glossary/domain-name-system-security/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Because applications and users depend on DNS to locate services, manipulation or disruption can redirect traffic, prevent access, expose browsing behavior, or undermine other controls.

Different mechanisms solve different problems. DNSSEC lets a resolver validate signed DNS data; it does not encrypt queries or show that the destination itself is safe. Encrypted DNS protects the client-to-resolver transport from observation or alteration; it does not provide DNS data-origin authentication, which is DNSSEC’s role. Protective DNS applies policy to block or redirect known or suspected harmful destinations.

### Key points

- **Authoritative security:** Protect zone data, registrar access, name servers, signing keys, and administrative changes.
- **Recursive security:** Harden resolvers, restrict abuse, validate DNSSEC where appropriate, and monitor query behavior.
- **Availability:** Use resilient architecture, controlled changes, capacity planning, and DDoS protection.
- **Important limitation:** DNS filtering is a useful layer, not proof of safety; attackers can use new domains, trusted platforms, direct addresses, or allowed services.

### Related terms

[Domain Name System Security Extensions (DNSSEC)](<https://yellowcube.eu/glossary/domain-name-system-security-extensions/>) · [Protective DNS](<https://yellowcube.eu/glossary/protective-dns/>) · [Distributed denial-of-service (DDoS) attack](<https://yellowcube.eu/glossary/distributed-denial-of-service-attack/>) · [Domain Name System (DNS) hijacking](<https://yellowcube.eu/glossary/domain-name-system-hijacking/>) · [Defense in depth](<https://yellowcube.eu/glossary/defense-in-depth/>) · [Cybersquatting](<https://yellowcube.eu/glossary/cybersquatting/>)

### Sources

[NIST SP 800-81r3: Secure DNS Deployment Guide](https://csrc.nist.gov/pubs/sp/800/81/r3/final) · [CISA: Protective DNS](https://www.cisa.gov/resources-tools/services/protective-domain-name-system-resolver)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.