Summary
This discussion brief from Authentic Web describes six domain and DNS problems that affect enterprise security, compliance and digital performance, how to find them and how to fix them. Its figures come from Authentic Web audits of 8 companies and 16,490 domains.
The Domain Name System (DNS) underpins every enterprise digital service. Yet, domain and DNS audits reveal compliance gaps in security policy enforcement. Manual change management processes will not work in the digitally transformed enterprise.
Peter LaMantia, CEO, Authentic Web Inc.
Key findings
- 62% of audited domains returned no name server response, while their DNS settings remained active.
- 66% of audited domains had no DNS security settings active. Only 11% had SPF, 21% DMARC, 2% DNSSEC and under 1% DKIM.
- Audited organizations used an average of 39 managed DNS services and 12 domain registrars.
- HTTPS as the default protocol on the top 10 million websites rose from 22.5% to 42.6% (W3Techs), so a lot of content is still unencrypted.
Why DNS matters now
The more ubiquitous something becomes, the less we notice it, until things go wrong. As enterprises drive digital transformation, the underlying DNS infrastructure becomes more strained and its weaknesses create exposure. Even small DNS errors can open the gates to brand damage, financial losses, breach of customer trust and corporate valuation impact. Domains and DNS are a corporate asset that underpins brand and customer experience, so marketing, IT and digital operations need to work together on security, compliance and digital performance. A little work on the DNS foundation keeps the brand “up to code”.
Problem 1: Untended legacy domains
Marketing teams order domains for one-time use, such as a seasonal campaign or event landing page. When the campaign ends, the DNS settings stay in service, forgotten. This can hurt SEO and, worse, unused legacy endpoints can give malicious parties an entry point to appropriate the domain.
Proof. Audits of thousands of domains across banking, healthcare and technology show huge numbers of domains that fail to resolve while active DNS settings remain in place. HTTP response codes by type (8 companies, 16,490 domains):
| Response | Share of domains |
|---|---|
| No name server response | 62% |
| Redirects | 22% |
| Apex: 200 | 14% |
| Forbidden / Not found | 2% |
| Service unavailable | 1% |
Solution. Know the exact HTTP response for each domain and its zone file records at all times. Redirect or expire domains that are no longer required.
Problem 2: Missing DNS security settings
DNS security is not only an IT concern. DMARC improves outbound email deliverability by 10 to 15% and is one of the most important defenses against email phishing.
- SPF (Sender Policy Framework): authenticates email associated with domains and helps prevent others sending phishing email using your domain.
- DMARC (Domain-based Message Authentication, Reporting and Conformance): builds on SPF to defend against email phishing.
- DNSSEC (Domain Name System Security Extensions): protocol extensions that secure the domain name resolving process and reduce the risk of man-in-the-middle exploits and cache poisoning.
Proof. Industry audits show most companies fail to activate DMARC, SPF and DNSSEC, and in many cases the settings, especially DNSSEC, are misconfigured. DNS security settings active, as a share of total domains (8 companies, 16,490 domains):
| Setting | Share of domains |
|---|---|
| No DNS security | 66% |
| DMARC | 21% |
| SPF | 11% |
| DNSSEC | 2% |
| DKIM | <1% |
Solution. Audit your domain and DNS network to find the gaps in DNS security protection that put the enterprise at risk.
Problem 3: Lack of HTTPS encryption
Google Chrome and other major browsers have standardized the requirement that websites be encrypted, which prevents snooping on customers’ browsing sessions and access to login credentials or bank account details. HTTPS as a website default rose from 22.5% to 42.6% on the top 10 million websites (ranked by Alexa). That figure does not capture HTTPS on subdomains or redirects, so a lot of unencrypted content remains. As companies encrypt every web property and redirect, managing all the SSL certificates becomes a costly challenge and burden for IT administrators.
Proof. Google and the large certificate authorities have encouraged universal HTTPS for years. Failing to protect your web pages can hurt search rankings and puts your company and customers at risk. Source of the adoption trend: W3Techs.
Solution. Audit your DNS network to find unencrypted pages, domains and redirected domains. Apply the correct HTTPS certificates with a robust certificate management system.
Problem 4: Multiple DNS providers
Even the most sophisticated enterprise needs two or three managed DNS services at most: a primary enterprise-class anycast provider, a secondary service with automated zone cloning for redundancy, and in some cases specialized services for unique CDN functions. Organizations commonly have several, even dozens, of active DNS providers with unrelated zones under different SLAs and control environments. That causes problems:
- No automated secondary DNS service, which hurts business continuity.
- More control complexity and operational cost.
- Difficulty getting accurate query data.
- More access controls that often lack change management compliance.
- Soft spots that open attack vectors to bad actors.
Proof. Audits of 8 companies from banking, telecom, manufacturing and technology show an average of 39 managed DNS services active, typically left over from past employees who have since departed. As printed: high 71, low 36, average 39.
Solution. Consolidate to a single DNS provider with secondary DNS redundancy, and make sure access, change management and audit controls are in place.
Problem 5: Multiple domain registrars
Acquisitions and legacy practices lead many organizations to use multiple registrars. That means no single consolidated view of all domains, multiple logins and management interfaces, disjointed notices such as renewals, and higher maintenance cost.
Proof. Audits of 8 companies from banking, telecom, manufacturing and technology show an average of 12 domain registrars (high 22, low 7).
Solution. Consolidate to a single corporate registrar with a unified, secure access and management system.
Problem 6: Lack of integrated systems
Enterprise operations run best on systems that connect securely, but domain and DNS management is rarely integrated:
- Task management systems do not connect to domain and DNS systems.
- Registrar portals rarely connect to DNS resource record management controls.
- DNS security extensions and HTTPS certificates are typically managed separately.
- Stakeholders rely on emails, spreadsheets and ticketing to get things done.
Proof. Few organizations have integrated their domain, DNS and ancillary services (such as HTTPS certificates) under a single management system; they work in silos.
Solution. Investigate modern, integrated domain and DNS management systems such as DNAM by Authentic Web.
Where to start
Ask three questions. If the answer to any is “no”, act:
- Do you have a unified, tamper-proof system to manage domains and the DNS?
- Can you prove that system enforces security policies and change management?
- Is the system integrated with registrar and managed DNS controls?
A third-party audit is the best first step. Authentic Web’s DNS audit costs $0.00, needs no internal resources and requires only a domain asset list. The output covers: an executive summary and recommendations; domain inventory by registrar service and by managed DNS service; a secondary DNS check-up; an IP/host review; apex HTTPS response inspection; a DNS security review (pass/fail on DNSSEC, SPF, DMARC and DKIM); an HTTPS encryption report; and an optional total cost of ownership session. It addresses four areas: DNS visibility, security risk, control gaps and system silos. To book the audit or get the IT self-assessment checklist, contact info@authenticweb.com.