Secure DNS: Your Performant Uptime Guardian

Secure DNS infrastructure (Secure DNS) refers to server instances for name resolution that are protected against external attacks by comprehensive protection solutions. Furthermore, DNS providers for Secure DNS usually support configurations with DNS extensions such as DNSSEC, which prevent malicious manipulation of name resolution.

By using DNS security, companies can protect the name resolution of their domains from external attacks. In fact, name servers are often the target of DDoS attacks. Cyber criminals switch their attacks from company websites to DNS servers if the first wave of attacks does not lead to the desired outcome. If the name server responsible for name resolution goes down, the underlying web resource also remains unavailable. A secure DNS infrastructure can protect against such attacks.  In addition to dedicated DDoS protection functions, anycast addressing in conjunction with a multiple (geo-)redundant server network also offers a high level of security against overload attacks. With Anycast, individual server cannot be targeted by attackers; the load is distributed across the entire network.

In general, companies obtain Secure DNS solutions from a specialized security service provider who operates the necessary hardware and provides name resolution as a service – in this case, no additional software or hardware is required for implementation. If there is also support for a hidden primary configuration, moving name resolution to secure Secure DNS servers, including the associated configuration, can be done quickly and easily. If, on the other hand, a secure DNS infrastructure is to be set up in-house, this involves considerable costs for software, hardware and personnel. In particular, constellations with high-performance DNS server networks in anycast operation are largely ruled out in-house. The costs and benefits are disproportionate here. Outsourcing to a Secure DNS provider is therefore the best choice for dedicated DNS server protection. Operating a secure DNS server yourself only makes sense in exceptional cases (intranet and the like) because the data stored there is made publicly available anyway.

If cybercriminals are unsuccessful with their DDoS attacks on an organization's web servers, they often shift their attacks to name resolution. If the cybercriminals reach their target there, the availability of the affected domains is severely restricted, even though the origin servers are not burdened by malicious traffic. For this reason, securing name resolution with DNS security is a key element in protecting critical web processes.