Protective DNS in the Enterprise: Blocking Command-and-Control, Phishing, and Data Exfiltration at the Resolver
Before malware can phone home or a user can load a phishing kit, a DNS query has to resolve. Protective DNS turns the oldest protocol on the internet into one of your fastest, lowest-friction security controls.
The Domain Name System (DNS) is the phonebook of every network transaction, yet in many enterprises it is treated purely as plumbing. Whenever a user clicks a credential-harvesting link, a compromised server pulls a second-stage payload, or an IoT camera beacons to a botnet controller, the very first network action is a DNS lookup. If you inspect and policy-enforce that lookup, you stop the attack before a TCP handshake ever completes—even on devices that cannot run an EDR agent.
What Protective DNS Stops Across the Kill Chain
| Threat Class | DNS Indicator | Protective DNS Action |
|---|---|---|
| AiTM Phishing & Lookalike Domains | Resolution of Newly Observed Domains (NODs) or cousin domains within 48h of registration | Sinkhole or block resolution; serve warning page |
| Malware C2 & Domain Generation Algorithms (DGA) | High rate of NXDOMAIN responses and high-entropy algorithmic domain queries | Block C2 callbacks; trigger high-priority SOC containment alert |
| DNS Tunneling & Data Exfiltration | High volume of TXT/NULL queries with high-entropy base64/hex subdomain labels | Throttle/block authoritative domain; alert on data exfiltration |
| Unmanaged IoT & OT Compromise | Printer, VoIP phone, or building controller querying external non-vendor domains | Enforce strict allow-list DNS policies per VLAN/subnet |
Governing Encrypted DNS (DoH and DoT)
Modern browsers and operating systems support DNS over HTTPS (DoH) and DNS over TLS (DoT). While encrypted DNS protects privacy on public Wi-Fi, unmanaged DoH inside an enterprise network blinds your SOC by sending DNS queries over port 443 to public resolvers outside your visibility.
- Publish Enterprise DoH/DoT Endpoints via MDM & GPO: Configure Chrome, Edge, Firefox, Windows, and macOS via group policy to use your enterprise Protective DNS resolver over encrypted transport.
- Block Known Public DoH Resolver IPs at the Firewall: Prevent malware and rogue applications from hardcoding calls to public DoH providers to evade corporate DNS logging.
- Stream Full DNS Query Logs to Your SIEM: Log the client source IP, roaming agent identity, queried FQDN, record type, response code (especially bursts of
NXDOMAIN), and resolved IP—giving incident responders an instant historical map of every host that ever looked up an indicator of compromise.
Turn DNS Into an Enterprise-Wide Sensor and Shield
We design Protective DNS and Zero Trust network architectures that protect managed workstations, cloud VPCs, and agentless IoT/OT estates alike.
Kinematic Digital designs and operates enterprise cybersecurity programmes, from cloud posture and identity hardening to offensive validation. Explore our cybersecurity services and preemptive cybersecurity programme, or schedule an executive security briefing.
Frequently Asked Questions
What is Protective DNS (PDNS)?
Protective DNS is a security service that inspects DNS queries before resolving them, blocking connections to known malicious domains, newly registered phishing domains, command-and-control (C2) infrastructure, and DNS tunneling channels.
Why is DNS such a high-leverage control point for cybersecurity?
Almost every cyberattack—whether phishing, malware staging, or ransomware command-and-control—requires resolving a domain name before a network connection opens. Blocking at the DNS layer severs the attack before a single packet reaches the malicious server.
How does DNS over HTTPS (DoH) affect enterprise visibility?
If browsers or applications use unmanaged public DoH resolvers (like 8.8.8.8 or 1.1.1.1 over port 443), DNS queries bypass corporate protective DNS filters and SIEM logging. Enterprises must block unauthorized public DoH endpoints and steer encrypted DNS to their managed enterprise resolver.
What is DNS tunneling and how do we detect it?
DNS tunneling encodes stolen data or command-and-control traffic inside DNS TXT, CNAME, or A record queries to an attacker-controlled authoritative nameserver. Detect it via payload entropy analysis, query volume anomalies per domain, and unusually long subdomain labels.
Should we block Newly Observed Domains (NODs) at the DNS layer?
Yes. Domains registered or first seen on the internet within the last 24 to 72 hours disproportionately host phishing kits and malware droppers while rarely serving legitimate enterprise business needs.