--- id: CP-221 slug: dns-internet-phonebook-vulnerabilities lang: en title: DNS, the Internet's phonebook description: DNS links a site name to its address, and nobody sees it happen. Why attackers target it, and what an employee does. canonical_url: https://startbrain.io/cyberpedia/en/articles/dns-internet-phonebook-vulnerabilities/ markdown_url: https://startbrain.io/cyberpedia/en/articles/dns-internet-phonebook-vulnerabilities.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "DNS, the Internet's phonebook", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/dns-internet-phonebook-vulnerabilities/ (CC BY 4.0) wing: 3 theme: browse_safely reflex: cr-057 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/dns-internet-phonebook-vulnerabilities/ fr: https://startbrain.io/cyberpedia/fr/articles/dns-annuaire-internet-vulnerabilites/ de: https://startbrain.io/cyberpedia/de/articles/dns-telefonbuch-internet-schwachstellen/ es: https://startbrain.io/cyberpedia/es/articles/dns-agenda-telefonica-internet-vulnerabilidades/ sources: - "n": 1 title: SP 800-81 Rev. 3, Secure Domain Name System (DNS) Deployment Guide publisher: NIST url: https://csrc.nist.gov/pubs/sp/800/81/r3/final published: "2026-03-19" accessed: "2026-11-03" - "n": 2 title: "ED 19-01: Mitigate DNS Infrastructure Tampering (Closed)" publisher: CISA url: https://www.cisa.gov/news-events/directives/ed-19-01-mitigate-dns-infrastructure-tampering-closed published: "2019-01-22" accessed: "2026-11-03" - "n": 3 title: "Compromise Infrastructure: DNS Server, Sub-technique T1584.002 - Enterprise" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1584/002/ accessed: "2026-11-03" - "n": 4 title: "Application Layer Protocol: DNS, Sub-technique T1071.004 - Enterprise" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1071/004/ accessed: "2026-11-03" - "n": 5 title: Dynamic Resolution, Technique T1568 - Enterprise publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1568/ accessed: "2026-11-03" --- # DNS, the Internet's phonebook DNS (Domain Name System) is the phonebook that lets a browser or a mail client find the service behind a domain name. NIST describes it as an integral part of any enterprise network architecture: an attack on a company's DNS threatens all of its network operations [1]. For an employee, this step is invisible. The address shown in the browser can be correct and still lead somewhere else if the phonebook has been altered. This page explains why attackers are interested in it and what is left for the user to do, the rest being a matter for technical teams. ## In 30 seconds - Where it happens: every time a site or a mail service is opened, with no visible sign, including on a site you know. - What the attacker wants: to redirect web and mail traffic to their own infrastructure in order to inspect it, or to hide communications inside DNS traffic [2][4]. - The reflex: check the address displayed, be wary of misspelled domain names, report any unusual behavior to support and never change your DNS settings on your own. - If it has already happened: tell support right away and give the site, the time and what you entered. ## Straight answers ### What does DNS do, concretely? It associates a service name with an address. CISA gives an example: to help users reach a mail or collaboration service, an organization points a name in its own domain to its provider's domain [2]. The employee types or clicks a name, and DNS decides where they land. ### Why is it a target? Because a change made at the right place affects all the users of a domain at once. CISA describes attackers who redirected and intercepted web and mail traffic [2]. MITRE notes that by taking control of a DNS server, an attacker can modify DNS records and redirect an organization's traffic [3]. ### Will I see a warning if my traffic is hijacked? Not necessarily. According to CISA, an attacker who sets the DNS values themselves can obtain valid encryption certificates for the organization's names. The redirected traffic can then be decrypted, and because the certificate is valid for the domain, the user receives no error alert [2]. ### Can I change my DNS myself to be safer? No. A company's DNS falls under several technical roles, each with its own security concerns [1]. A personal setting on a work device falls outside that framework and can bypass the protections the company has put in place. If a site seems slow or strange, support decides what to do. ### Can DNS be used for anything other than redirecting? Yes. MITRE describes DNS tunneling: commands sent to a compromised system, and often their results, are hidden in DNS traffic [4]. This protocol is common in environments and may be allowed before network authentication has even finished [4]. ## How it works A domain name has value only through the records associated with it. CISA cites, for example, address records (A), mail server records (MX) and name server records (NS) [2]. The attack path described by CISA has three steps. The attacker compromises, or otherwise obtains, the credentials of an account that can modify DNS records. They then replace a service's legitimate address with an address they control, which lets them examine or manipulate the traffic before, if they choose, passing it on to the real service. Finally, they can obtain valid certificates to decrypt this traffic and read the data users enter [2]. CISA adds that this risk persists beyond the redirection period [2]. MITRE points to another possibility: silently creating subdomains that point to malicious servers, without the owner of the DNS server noticing [3]. The same text states that much of this activity takes place out of view of the targeted organization, which makes detection difficult [3]. DNS also serves as a command channel. In the DNS beaconing technique, commands pass through DNS requests, in TXT or A type records. These beacons are hard to spot because they rarely communicate with the infected devices, which drowns them in normal traffic [4]. Dynamic resolution, for its part, lets malware adjust the domain name, IP address or port it uses [5]. ## What you do - Read the displayed address before entering a password or data. Compare it letter by letter with the usual address: a similar domain name with a typo leads to a different site. - Do not rely on the absence of a browser alert. A valid certificate does not prove that no redirection took place [2]. - Open your services through your bookmarks or through the official address the company provides rather than through a link you received. - Report any unusual behavior to your support: an unexpected login page, a mail service that behaves differently, a known site that looks different. - Do not change the DNS settings of your device or of your office router. ## Pitfalls First pitfall: believing that a correct address is enough. In the attacks described by CISA, it is the phonebook that is altered, not the address the user types [2]. Second pitfall: thinking that the subject concerns only IT staff. The attack starts with credentials: CISA required US federal executive branch agencies to change the passwords of accounts able to modify DNS and to add multifactor authentication [2]. It recommends phishing-resistant factors and advises against SMS authentication [2]. An employee who manages a domain name or an account with a DNS host is directly concerned. Third pitfall: assuming the provider is always safe. MITRE lists the compromise of third-party DNS servers among attacker techniques, which spares them from setting up their own servers [3]. Dynamic DNS services, such as DuckDNS, were used by the APT-C-36 group to redirect victims to sites or repositories hosting malware [5]. An unknown domain name is therefore no sign of trust, whatever its appearance. ## Real cases ### January 2019: CISA's emergency directive On January 22, 2019, CISA published emergency directive ED 19-01, "Mitigate DNS Infrastructure Tampering" [2]. It stated that it was tracking a series of DNS infrastructure tampering incidents and was aware that several US executive branch agency domains were affected [2]. It required four actions from agencies. The first three, to be completed within 10 business days, were to audit public DNS records, change the passwords of the accounts concerned and add multifactor authentication [2]. For the fourth, CISA began, within 10 business days, to deliver the new certificates to certificate transparency logs, and agencies had to monitor them upon receipt [2]. CISA's text now states that it concluded the directive's objective was met and that it closed the directive [2]. ### 2019: the Sea Turtle campaign MITRE links to the Sea Turtle group the modification of name server (NS) records to point to DNS servers it controlled, in order to provide the answers to all DNS requests [3]. Among MITRE's references is a Cisco Talos analysis dated April 17, 2019, "Sea Turtle: DNS Hijacking Abuses Trust In Core Internet Service", followed by a second one dated July 9, 2019 [3]. The sources in the file do not detail the victims of this campaign. ## For technical teams The NIST SP 800-81 Rev. 3 guide, published in March 2026, replaces the 2013 version [1]. It gives deployment recommendations to secure the DNS protocol and infrastructure, limit configuration errors and add a layer of network security [1]. Among its keywords are DNSSEC, encrypted DNS, protective DNS and DNS logging [1]. The CISA directive also points to monitoring issued certificates and keeping an inventory of managed domains [2]. ## Sources 1. NIST, "SP 800-81 Rev. 3, Secure Domain Name System (DNS) Deployment Guide", 19 March 2026. https://csrc.nist.gov/pubs/sp/800/81/r3/final (accessed 3 November 2026) 2. CISA, "ED 19-01: Mitigate DNS Infrastructure Tampering (Closed)", 22 January 2019. https://www.cisa.gov/news-events/directives/ed-19-01-mitigate-dns-infrastructure-tampering-closed (accessed 3 November 2026) 3. MITRE ATT&CK, "Compromise Infrastructure: DNS Server, Sub-technique T1584.002 - Enterprise". https://attack.mitre.org/techniques/T1584/002/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Application Layer Protocol: DNS, Sub-technique T1071.004 - Enterprise". https://attack.mitre.org/techniques/T1071/004/ (accessed 3 November 2026) 5. MITRE ATT&CK, "Dynamic Resolution, Technique T1568 - Enterprise". https://attack.mitre.org/techniques/T1568/ (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/dns-internet-phonebook-vulnerabilities/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.