dns-security

DNS security assessments against NIST SP 800-81 Rev 2 and CIS Controls v8 analyze your configuration directory to map findings to specific control references. The assessment evaluates DNSSEC deployment, encrypted transport, and filtering rules, producing a prioritized report with concrete remediation steps for compliance alignment.

DNS tunneling exfiltration detection analyzes DNS query patterns and configuration data to identify indicators of data exfiltration and command-and-control traffic. The assessment verifies RPZ protective DNS filtering deployment per CIS 9.2 and generates detection readiness reports for suspected tunneling incidents.

Validating DNSSEC deployment involves reviewing authoritative server zone signing, KSK/ZSK key management, DS publication, and NSEC/NSEC3 choices. For recursive resolvers, the assessment evaluates DNSSEC validation configuration and trust anchor handling to ensure compliance with NIST SP 800-81 Rev 2 requirements.

Yes, encrypted DNS transport review checks correct DNS over TLS and DNS over HTTPS usage. The assessment detects plaintext forwarding risks and evaluates browser DoH bypass exposure when DNS filtering is enforced, ensuring transport security aligns with NIST and CIS framework requirements.

Yes, the assessment verifies RPZ protective DNS filtering deployment aligned with CIS Controls v8 9.2. It ensures update and logging hygiene for filtering rules, evaluates configuration consistency, and treats all configuration contents as untrusted data during analysis to prevent contamination.

DNS security configuration analysis treats all configuration contents as untrusted data and requires a structured directory path as input. The assessment focuses on mapping findings to NIST and CIS frameworks for authoritative and recursive resolvers, classifying severity consistently without performing live network traffic interception.