DNS Security Hardening Techniques for Small Business

Why DNS Security Matters for Your Business

DNS is the phone book of the internet. When someone types your website address, DNS servers translate that name into an IP address so browsers know where to go. If attackers compromise your DNS, they can redirect your customers to fake sites, intercept emails, or take your business offline entirely.

Small businesses often overlook DNS security because it seems technical and abstract. But the consequences are concrete: lost revenue, stolen credentials, and damaged reputation. The good news is that hardening your DNS doesn't require a security team or expensive tools.

Use a Reputable DNS Provider

Your domain registrar often provides DNS hosting, but their service may lack security features. Consider moving your DNS to a provider that specializes in it.

Look for these features:

• DNSSEC support (more on this below)
• DDoS protection at the DNS level
• Access logs and monitoring
• Two-factor authentication for account access
• API access for automation

Providers like Cloudflare, Route 53, and DNSMadeEasy offer free or low-cost plans suitable for small businesses. The key is separating your DNS hosting from your domain registration. This limits damage if one account gets compromised.

Enable DNSSEC

DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records. This prevents attackers from injecting fake responses when someone looks up your domain.

Without DNSSEC, an attacker on a coffee shop network could intercept DNS queries and send back malicious IP addresses. With DNSSEC, the resolver can verify that responses actually came from your authoritative DNS server.

Enabling DNSSEC involves two steps:

1. Sign your DNS zone at your DNS provider (usually a checkbox or button in their control panel)
2. Add DS records at your domain registrar to establish the chain of trust

Your DNS provider should give you the DS records after you enable signing. Copy these into your registrar's interface. Most registrars now support DNSSEC, though the interface varies.

Test your DNSSEC setup at dnsviz.net. You should see green boxes indicating valid signatures.

Lock Your Domain Registration

Domain hijacking happens when attackers gain access to your registrar account and transfer your domain to another registrar. Once they control the domain, they control your DNS.

Take these steps:

• Enable registrar lock (also called transfer lock or domain lock)
• Use a strong, unique password for your registrar account
• Enable two-factor authentication
• Set up a registry lock if your registrar offers it (adds a manual verification step before any changes)
• Use a dedicated email address for domain management, not your general business email

Some registrars offer additional security features like out-of-band verification for changes (they call you) or WHOIS privacy protection. Use what's available.

Implement CAA Records

CAA (Certification Authority Authorization) records tell certificate authorities which organizations are allowed to issue SSL certificates for your domain. This prevents attackers from obtaining valid certificates for your domain from sketchy certificate authorities.

A basic CAA record looks like this:

example.com. CAA 0 issue "letsencrypt.org" example.com. CAA 0 issuewild "letsencrypt.org" example.com. CAA 0 iodef "mailto:security@example.com"

The first two lines specify which CA can issue certificates. The third line sets an email address for violation reports. If someone tries to get a certificate from an unauthorized CA, you'll get notified (assuming the CA checks CAA records, which most major ones do).

Add CAA records through your DNS provider's control panel. If you use multiple certificate authorities or CDN services, you may need multiple issue lines.

Monitor DNS Changes

Set up monitoring to alert you when DNS records change. Many DNS providers offer this built-in. You can also use third-party services or simple scripts that query your DNS periodically and compare results.

At minimum, monitor:

• A and AAAA records (IP addresses)
• MX records (email routing)
• NS records (nameserver changes)
• TXT records (often used for email authentication)

Some DNS providers let you set up approval workflows where changes require confirmation from multiple people. This adds friction but prevents a single compromised account from causing damage.

Use Split DNS for Internal Resources

If you have internal servers or services, don't put them in public DNS. Use a separate internal DNS zone that only your network can access.

For example, your public DNS might have:

www.example.com -> 203.0.113.10 mail.example.com -> 203.0.113.20

Your internal DNS would have:

fileserver.internal.example.com -> 10.0.1.50 printer.internal.example.com -> 10.0.1.100

This keeps internal infrastructure hidden from attackers scanning public DNS. It also prevents accidental exposure of internal IP addresses.

Configure DNS Filtering for Outbound Queries

Your business network makes thousands of DNS queries daily. DNS filtering blocks requests to known malicious domains, preventing malware from communicating with command-and-control servers or stopping employees from accidentally visiting phishing sites.

Options include:

• Configuring your router or firewall to use filtering DNS resolvers (like Cloudflare's 1.1.1.2 or Quad9)
• Using a business DNS filtering service
• Setting up your own filtering resolver with software like Pi-hole

DNS filtering won't catch everything, but it's a simple layer that blocks a lot of common threats. Many filtering services also provide logs showing what got blocked, which helps identify infected devices.

Set Appropriate TTL Values

TTL (Time To Live) tells DNS resolvers how long to cache your records. Longer TTLs reduce DNS query load but make changes slower to propagate. Shorter TTLs let you make changes quickly but increase query volume.

For most small businesses:

• Use 1-4 hours (3600-14400 seconds) for normal operations
• Lower to 5-10 minutes before planned changes
• Raise back after changes complete

Very short TTLs (under 5 minutes) can cause performance issues and don't provide much benefit unless you're actively making changes. Very long TTLs (over 24 hours) make incident response harder if you need to redirect traffic quickly.

Regular Security Audits

Quarterly, review:

• Who has access to your DNS and registrar accounts
• Whether all DNS records are still needed (remove old ones)
• Your DNS provider's security features and whether you're using them
• Logs for suspicious queries or changes

This doesn't need to take long. Thirty minutes every few months can catch issues before they become problems.

If you need help implementing these techniques or want a professional review of your current setup, our security services team can help. We work with small businesses to implement practical security measures that fit your budget and technical capabilities.

Getting Started

Start with the high-impact, low-effort items:

1. Enable two-factor authentication on your registrar and DNS provider accounts
2. Enable registrar lock on your domains
3. Add CAA records
4. Set up basic monitoring or alerts

These four steps take less than an hour and prevent the most common DNS attacks. Once those are in place, work through DNSSEC and the other techniques.

DNS security isn't glamorous, but it's foundational. A compromised website can be restored from backups. A hijacked domain can put you out of business for days or weeks. Taking time to harden your DNS now prevents much bigger headaches later.

Need help with your DNS security or website infrastructure? Contact our team for a consultation.

FAQ

How much does DNS security cost for a small business?

Most DNS security features are free or very low cost. DNSSEC, CAA records, and registrar locks are typically included with your existing services. Premium DNS hosting with advanced security features runs $5-50/month depending on traffic volume. The biggest cost is time to set things up properly.

Will DNSSEC break my website or email?

No. DNSSEC is transparent to end users and applications. If you misconfigure it, the worst case is that some strict resolvers won't return your DNS records until you fix the configuration. Most DNS providers have validation tools that catch errors before they cause problems. Test thoroughly in your DNS provider's interface before adding DS records at your registrar.

How do I know if my DNS has been compromised?

Signs include unexpected changes to DNS records, customers reporting they're being redirected to wrong sites, SSL certificate warnings for your domain, or email delivery problems. Set up monitoring to alert you to record changes. If you suspect compromise, immediately change passwords, review all DNS records, check your registrar account for unauthorized changes, and consider temporarily moving DNS to a new provider while you investigate.