DNS Security

Sponsored
by

Noteworthy

WHOIS History API: Powering Domain Investigations

Reverse WHOIS: A Powerful Process in Cybersecurity

Domain Research and Monitoring: Keeping an Eye on the Web for You

Blogs

DNS Security Gets Fixed When Someone Notices - Not Before

A study of 309 universities, museums and sports brands finds DNS security follows visible threats rather than technical risk, leaving organisations well protected against familiar attacks while quieter weaknesses in critical infrastructure persist unnoticed.

Phantom Squatting: When LLMs’ Hallucination Becomes an Attacker’s Best Friend

As AI reshapes cybersecurity, attackers are exploiting a fundamental weakness in large language models. Phantom squatting turns hallucinated domain names into trusted attack vectors, creating a new class of DNS abuse that defenders cannot solve by eliminating hallucinations alone.

Call for Participation: DNSSEC and Security Workshop at ICANN87 (21 October 2026)

ICANN is inviting proposals for its DNSSEC and Security Workshop at ICANN 87, offering experts and practitioners a platform to share insights on DNS security, routing security, browser security, and emerging Internet infrastructure challenges.

The 2024-2026 Root Zone KSK Rollover: Updates and Observations

Roughly a year and a half ago, Verisign and ICANN began the important, multi-year process of updating the cryptographic key that secures the authoritative DNS root zone. This work has been largely invisible to the public, but vital to the security of many everyday online activities.

Digital Sovereignty Is More Than Data Sovereignty: Understanding Africa’s Digital Dependency Stack

Africa's pursuit of digital sovereignty demands more than keeping data at home. True resilience depends on controlling the infrastructure, platforms, cybersecurity capabilities, governance, and human expertise that underpin an increasingly interconnected digital economy across Africa.

The Question Isn’t Whether the Harm Is Real - It’s Who Should Act

Measuring online abuse can reveal its scale, but not who should intervene. Effective policy must distinguish harm from contractual responsibility, identify the actors best placed to act, and target remedies where they can work effectively.

What the Interisle Report Reveals, and What It Doesn’t, About DNS Abuse

Interisle's report illuminates malicious registration trends, but its broad blocklist methodology measures different questions than DNS Abuse, complicating conclusions about registry and registrar accountability by conflating reputation signals with actionable domain enforcement decisions for policymakers.

.PK ccTLD Governance Issues and Pakistan’s Digital Future

Pakistan's .pk domain has long been controlled by a private company abroad, raising concerns over digital sovereignty, cybersecurity and accountability. Repeated breaches, offshore infrastructure and weak governance have left a critical national asset exposed and contested.

When AI Writes the Scam: How Artificial Intelligence Is Making DNS Abuse Harder to Detect

Artificial intelligence is transforming phishing and DNS abuse, erasing the linguistic clues that once exposed scams. As attacks become personalised, automated and multilingual, governance frameworks are struggling to keep pace with a rapidly expanding threat surface.

Post-Quantum Cryptography - the Time to Act Is Now

As quantum computing advances, the race to secure the internet is becoming urgent. Experts at EuroDIG 2026 warned that only coordinated, multistakeholder action can accelerate post-quantum cryptography deployment before existing encryption becomes dangerously obsolete.

Fake Domains, Real Harm: The Data Behind India’s DNS Abuse Crisis

New data on DNS abuse reveals most malicious domains remain active beyond 24 hours, while a handful of registrars host the bulk of infrastructure, leaving India's population of first-generation internet users uniquely exposed to fraud.

Procedural Resilience or Technological Rigidity? Reassessing Article 19’s DNS Abuse Framework in the Post-MLAT Era

As cross-border cyber enforcement falters, critics argue Article 19's DNS abuse framework prioritizes procedural purity over user protection, leaving courts too slow to counter AI-driven phishing, rapid-flux domains, and increasingly automated online threats.

Domain Security Report: Unicorns Show Strong Adoption in Key Domain Security Measures

Unicorn firms lead in DNS-based security adoption, signaling technical maturity, while Global 2000 rely on enterprise registrars. Gaps in redundancy and brand protection expose supply chain risks as cyberattacks intensify across industries globally today.

Trusted Notifier Network (TNN) Core Concept 1: Unfair Cost Transfer and Reversal of Commercial Best

A flawed abuse-response system shifts costs from perpetrators to intermediaries, overwhelming enforcement. The Trusted Notifier Network seeks to realign incentives, curb low-quality reporting, and restore efficiency by embedding trust, accountability, and cost redistribution.

Moving Beyond Associated Domain Checks: The Urgent Need to Ban Short-Term Domain Leasing

ICANN's new DNS abuse rules mark progress, yet short-term domain leasing enables fleeting, hard-to-detect attacks. A proposed 30-day minimum lease could curb cybercrime by undermining the economics of weaponised parked domains.

News Briefs

NANOG 95: From Faster Fibre to Route Leaks, Operators Face Old Problems with New Tools

AWS Unveils Route 53 “Accelerated Recovery” to Bolster DNS Resilience

DNS Under Strain: Technical and Policy Challenges in Supporting the Internet of Autonomous Things

14th Registration Operations Workshop Set for September 30, 2025

The Edgemoor Research Institute and TWNIC Launch Project Jake to Advance DNS Security and Data Transparency

DNSSEC Failure Causes Massive Website Outages on Russian Internet

Analysis of 7.5 Trillion DNS Queries Reveals Public Resolvers Dominate the Internet

EU-based DNS Internet Infrastructure Beginning to Take Shape, Planned to Onboard 100 Million Users

DNS Abuse Institute Launches Centralized DNS Abuse Reporting Service

CENTR Publishes Comment on the European Commission’s DNS Abuse Study

InternetNZ Has Disclosed a Vulnerability That Can Be Weaponized Against Authoritative DNS Servers

Security Researcher Dan Kaminsky Has Died

PIR Launches New Institute to Combat DNS Abuse

DNSSEC Now Deployed in all Generic Top-Level Domains, Says ICANN

Firefox Starts the Roll Out of DNS Over HTTPS (DoH) by Default for US-Based Users

Microsoft Announces Plans to Adopt DoH in Windows

EFF: For ISPs to Retain Power to Censor the Internet, DNS Needs to Remain Leaky

Leading Domain Registries and Registrars Release Joint Document on Addressing ‘DNS Abuse’

The U.S. House Judiciary Committee Is Investigating Google’s Plans to Implement DNS Over HTTPS

Use of DNS Firewalls Could Have Prevented More Than $10B in Data Breach Losses Over the Past 5 Years

Most Viewed

Security Researcher Dan Kaminsky Has Died

DNSSEC: Once More, With Feeling!

CircleID’s Top 10 Posts of 2017

Internationalizing the Internet

DNS, DNSSEC and Google’s Public DNS Service

Most Commented

WhoisXML API Updates – Sponsor

Global Domain Activity Trends Seen in Q2 2026

WhoisXML API's Q2 2026 analysis reveals rising domain registrations, shifting TLD rankings, growing DNS infrastructure concentration, and evolving malicious domain activity, based on billions of DNS records and millions of newly registered and confirmed malicious domains. more

APT37 Strikes Again, This Time with NarwhalRAT

North Korea's APT37 has launched a new NarwhalRAT campaign using spearphishing emails and malicious LNK files to deploy data-stealing malware. Researchers also uncovered infrastructure links and fresh indicators that expand the group's known operational footprint. more

A DNS Investigation of LenAI’s ErrTraffic ClickFix Distribution Network

An analysis of LenAI's ErrTraffic ClickFix infrastructure uncovered new DNS links, exposing malicious domains, IPs, typosquatting clusters, and email connections that broaden threat visibility and support stronger detection and incident response through expanded network intelligence. more

Inside a TDS-Powered ClickFix Malware Ecosystem: A DNS Deep Dive

DNS analysis of a malware distribution ecosystem uncovered thousands of linked artifacts, exposing typosquatting, malicious infrastructure and victim connections that broaden detection opportunities beyond Check Point Research's original indicators through expanded DNS intelligence correlation efforts. more

DNS Investigation: Threat Actor TA4922 Goes Global

TA4922 is expanding beyond nearby targets, deploying a fast-changing malware arsenal across Europe and Africa. A DNS investigation uncovered thousands of connected domains, dozens of malicious assets and signs of compromised victim infrastructure worldwide today. more

Under the DNS Hood of an Ongoing Legacy MSHTA Tool Attack

A DNS analysis of infrastructure behind ongoing MSHTA abuse uncovered malicious registrations, typosquatting clusters, victim activity, and hundreds of linked indicators, revealing how legacy Windows tooling continues enabling modern malware campaigns through interconnected DNS intelligence. more

macOS ClickFix Campaign Delivers AMOS and Other Infostealers: A DNS Deep Dive

A DNS deep dive into Microsoft's macOS ClickFix campaign uncovered victim infrastructure, typosquatting clusters, malicious registrations, and hundreds of linked indicators, exposing a broader infostealer ecosystem beyond the original 140 network IoCs identified by Microsoft. more

Industry Updates

Participants – Random Selection