DNS Protection
Protect the route every customer takes to find your business.
Review the domains, records, accounts and providers your websites, applications and email depend on, before a change or an outage takes them offline.
Tell us what you run. We'll help define the next step.
What we focus on
- Domain, zone and record inventory
- Registrar, provider and account security
- Resilience, monitoring and recovery
- Scoped to your environment
- Clear deliverables, agreed upfront
- No account needed to enquire
DNS Protection Services
DNS decides whether anyone can reach your business at all. It is also the layer most likely to be administered by whoever set it up years ago, through an account nobody has reviewed since. A single expired domain, a registrar account without a transfer lock or a record changed without approval can take down web, mail and application access at once, and the recovery time depends almost entirely on preparation done beforehand.
Our DNS protection service is for organisations running business-critical domains, multiple brands or a long tail of subdomains that has grown over time. We help teams build an accurate inventory, tighten registrar and provider account access, remove stale records that create takeover risk, improve resilience against provider outages, and put a change and recovery process in place. The engagement is scoped around your existing registrar and DNS providers rather than requiring a migration.
DNS protection for the route every customer takes to reach you
DNS is the first step in almost every transaction your business handles, and it is usually the least monitored part of the stack. A DNS protection engagement reviews domains, zones, records, registrar and provider accounts, nameserver resilience and the change process behind the web, mail and application records your business depends on.
We inventory what resolves, tighten who can change it, test whether a single provider outage would take you offline and write the change and recovery process, working through the control areas in NIST SP 800-81-2, the Secure Domain Name System Deployment Guide. The aim is fewer preventable outages, a smaller chance of an unauthorised record change and an end to the quiet drift that builds up across domains nobody clearly owns.
Most DNS incidents are not sophisticated. They come from a domain that expired, a registrar account without multi-factor authentication, a record changed by someone who has since left, or a single provider outage nobody planned around. This service concentrates on ownership, access, resilience and the ability to recover quickly.
Best fit for
- Businesses running multiple domains, subdomains or brands
- Teams with unclear DNS ownership or undocumented record history
- Services where a DNS outage would stop sales, logins or email
What you receive
- A documented domain, zone and record dependency map
- Access, MFA and change-control recommendations for DNS accounts
- A resilience and recovery plan for business-critical records
DNS protection areas we help you plan
Good DNS protection is mostly about control and recovery rather than exotic technology. It gives your team an accurate record of what exists, who is able to change it, and how quickly a mistake or a malicious change can be undone.
Domain, zone and record inventory
We build a current picture of the domains you own, the zones behind them and the records that matter: web and application hosts, mail routing and authentication records, verification tokens, third-party service records and anything pointing at infrastructure you no longer use. Stale records are a recurring source of both outages and subdomain takeover risk, so we identify what is live, what is orphaned and what should be removed.
Registrar, provider and account security
Control of DNS is control of the brand. We review who can log in to registrar and DNS provider accounts, whether multi-factor authentication is enforced, how many people hold administrative rights, whether registrar and transfer locks are enabled, and how API credentials used by automation are stored. Shared logins and personal email addresses on business-critical accounts are treated as findings, not conveniences.
Resilience, monitoring and recovery
We look at how many providers your resolution depends on, how TTL values would affect an emergency change, and whether anyone would notice a wrong or missing record before customers did. Alongside that we agree how zone data is backed up, who is authorised to make urgent changes, and the steps for restoring a known-good state after an error or an unauthorised modification.
A focused DNS scope before records are changed.
Before recommending providers, locks or DNSSEC, we build a practical picture of what resolves today, who controls it, and what would break if any of it stopped working.
Domains, zones and business dependencies
We identify the domains and subdomains in use across websites, applications, APIs, mail, marketing tools and internal systems, then connect each critical record to the service it supports. This shows where an outage would stop revenue, block logins or interrupt email, and which records deserve the most careful handling.
Access, ownership and change history
We review registrar and DNS provider accounts, administrative users, multi-factor authentication, transfer and registrar locks, API tokens and the process used to request changes. We also look for records that no longer have a clear owner, which are usually the ones that cause problems.
Resilience, TTLs and recovery
We review nameserver distribution, provider redundancy and TTL values against how quickly you might need to move traffic. We then agree monitoring, zone backups, documented recovery steps and who is authorised to act when a record is wrong outside working hours.
Start with the right scope.
Tell us which domains your business depends on, who administers them today and which registrar and DNS providers you use. We will confirm the proposed scope, provider responsibilities, deliverables, availability and pricing before work begins.
What a DNS protection engagement can include
- Domain, zone and critical record inventory
- Business dependency mapping for web, mail and application records
- Registrar and DNS provider account security review
- Stale and orphaned record findings, including takeover risk
- Nameserver resilience and provider redundancy recommendations
- DNSSEC and record-integrity guidance where supported
- Change-control, monitoring and recovery procedure
- Quote-ready scope with technology, effort and responsibilities defined
Request a quote for dns protection
Share the systems involved, your priorities and the tools you already use. We reply by email with the scope, availability and pricing once we have reviewed what you send.
Your enquiry is with our team.
We will review what you sent and reply to your email address. Nothing starts until scope and price are agreed in writing.
Explore services in the meantimeA DNS plan that survives outages, mistakes and staff changes.
Inventory comes before any change, so the records your business depends on are documented, owned and recoverable before anything is modified.
-
01
Inventory and dependency map
We collect the domains, zones and records in use, connect them to the services they support, and identify what is critical, what is stale and what has no clear owner.
-
02
Access and control review
Registrar and provider accounts, administrative users, multi-factor authentication, locks and API credentials are reviewed against the risk of an unauthorised or accidental change.
-
03
Resilience design
We assess provider redundancy, nameserver distribution, TTL strategy and DNSSEC suitability, then recommend changes in an order that avoids interrupting resolution.
-
04
Change and recovery handoff
We document the approved change process, monitoring, zone backups, recovery steps and who owns each domain going forward.
Questions teams ask before hardening DNS.
Before you give anyone access to a registrar account, you will want to know how we treat locks, DNSSEC and the risk of breaking resolution. These answers cover the questions that come up most.
Why does DNS need its own security review?
Because control of DNS is effectively control of the brand. Someone able to change records can redirect your website, intercept mail routing or issue certificates in your name, without touching your servers or application at all. DNS also tends to be administered informally, so access and ownership drift over time in a way that other systems do not. When CISA issued Emergency Directive 19-01 after a wave of DNS tampering, the required actions were exactly these basics: audit the records, change the account passwords, add multi-factor authentication and watch certificate transparency logs.
What is subdomain takeover and should we worry about it?
It happens when a DNS record still points at a third-party service that has been cancelled or deleted, allowing someone else to claim that service and serve content on your subdomain. It is common in organisations that have used many hosted tools over the years. Finding and removing orphaned records is a standard part of the inventory work.
Do we need DNSSEC?
It depends on your registrar, DNS provider, resolver support and operational capacity. DNSSEC provides integrity for responses, but it introduces key management and a real risk of outage if it is misconfigured or allowed to expire. NIST SP 800-81-2, the Secure Domain Name System Deployment Guide, sets out the key management and rollover duties that come with it. We assess whether it is appropriate for your estate and, if so, how it should be introduced and monitored.
Can you work with our existing registrar and DNS provider?
Usually, yes. Share the providers, the domains involved and how changes are currently requested. We will confirm whether the platforms are supported and whether the work covers review, hardening, resilience planning or a managed change process.
How do you avoid causing an outage during the work?
Nothing is changed without an agreed plan. Inventory and review come first, changes are sequenced so resolution is never dependent on a single untested step, TTLs are considered before edits, and zone backups plus documented rollback steps are in place before modifications are made.
Is this a one-off review or does it include ongoing monitoring?
The initial engagement is a review: inventory, ownership, access and resilience findings with recommendations. Ongoing monitoring for new or changed records, certificate expiry and provider alerts can be added as a managed arrangement if you want it maintained after the review, rather than checked again only when something changes.
Need a specific answer? Talk to our team
Further reading: NIST SP 800-81r2, Secure Domain Name System (DNS) deployment guide
Services that pair naturally with DNS protection.
DNS sits underneath almost everything else you publish. These services cover the adjacent risks that regularly surface during a DNS review.