DNS security is a service that checks every name lookup that a company's devices make, and refuses to look up the names of harmful websites. DNS, the Domain Name System, turns a website's name into the numeric address of its server. Almost every connection on the internet begins with such a lookup. So the lookup is the earliest point at which a harmful connection can be stopped.
Normally, a company's devices send their lookups to a DNS server called a resolver. The resolver finds the address and replies. With DNS security, the resolver also checks each name first. It compares the name with lists of harmful names from a threat intelligence platform. These lists hold the names of fake login pages, of sites that spread harmful software, and of the servers that attackers use to control infected computers. If the name is on a list, the resolver gives no address, or the address of a warning page.
DNS security also spots patterns in the lookups themselves. Some harmful software makes up thousands of random names every day, and tries each one until it finds its controller. A device that looks up hundreds of random names an hour stands out. Other harmful software hides stolen data inside the lookups, a little at a time. This is called DNS tunnelling. Unusually long or frequent lookups are a warning sign of it.
Say a chain of jewellery stores in Thrissur has a billing computer in each store. One computer is infected through a USB drive. At 3 a.m., the harmful software on it tries to look up a name that was registered the day before. The threat feeds already list that name as an attacker's control server. The resolver refuses to answer. Without the address, the harmful software cannot reach its controller, so it cannot receive instructions or send data out. The resolver sends an alert to the SIEM, naming the computer that asked.
DNS security needs nothing installed on the devices. Every device makes lookups, including printers, cameras and card machines. So it also protects devices that cannot run security software.
Large companies run their own DNS, together with the addresses of all their devices, through DDI (DNS, DHCP and IPAM) software. The makers of this software add DNS security on top. DNS security is simpler than a secure web gateway, which checks the web page itself. The company's public DNS, which tells the world where its website is, needs protection too. Attackers sometimes send it millions of lookups to knock it offline. DDoS protection absorbs that kind of attack.