A Complete Guide to Improved Management of Domains and the DNS

Large organizations with hundreds, even thousands of domains are finding domain management to be complex, costly, and hard for teams to manage. Understanding domain lifecycle challenges makes it easy to identify and solve the problems.

Corporate domain portfolios and the related DNS network are growing as businesses expand their digital footprints by embracing the cloud. Domains, subdomains, redirects, text, and other DNS records must be managed, not just set and forgotten. As portfolios grow, so does the associated work effort.

Domain and DNS management touches stakeholders across the organization. Marketing, product, digital operations, and intellectual property attorneys all register domains. Network operations, IT and infosec teams are responsible for setting up and managing DNS configurations. Every domain in a portfolio generates a permanent lifecycle management burden, yet stakeholders lack a unified view where ownership and governance can be efficiently maintained.

Adding to domain management workload is the fragmented state of the domain and DNS supplier industry. Vendors include domain registrars, managed DNS services, TLS Certificate Authorities and advisory firms. Most organizations use dozens of vendor/suppliers which operate in silos making the seamless management of domains, DNS and TLS certificates nearly impossible. This can have important consequences to the enterprise in security exposure, compliance gaps, and operational efficiency (Total Cost of Ownership).

Corporate domain portfolios are increasingly the source of cyber security breaches that have seriously damaged prominent brands and their customers. DNS hijacking and man-in-the-middle schemes expose brands and customers to credential and data theft. These exploits are becoming easier to execute because organizations have more domains and extended attack surfaces – all managed with manual processes by more people across more vendors.

Managing domains securely is costly. Organizations often understate their domain management costs measuring only the annual domain renewal fees, possibly including 3rd party domain management professional services. It’s the tip of the iceberg. The true cost must include the combined labor effort of all stakeholder activity through the domain lifecycle. The cost of managing, governing, and securing domains and the DNS over the portfolio lifecycle is significantly understated. IT teams are burdened with unproductive domain management tasks reducing their availability for higher priority work. TCO must consider all three; the hard dollars paid to vendors, the time expended by stakeholders and the opportunity costs of unproductive domain and DNS administration work.

Domain management is much more complex today than it was in the 1990s. Companies own orders of magnitude more domains. Additionally, there are over 1,000 top-level domains to consider and the DNS networks now extend the digital footprint. Business is digital and digital runs on the DNS.

Unfortunately, most domain registrar administration portals and DNS management tools are little different today than they were at the turn of the century. Most organizations operate DNS networks with manual processes lacking end-to-end change management systems or controls. Manual domain management is costly, inefficient, and insecure, yet solutions aren’t easy when overall ownership is unclear and internal stakeholders abound, operating in silos. Further complicating matters, the external vendor ecosystem within enterprises is fragmented. It’s time to take a look at the best practices for end-to-end domain management lifecycle.

The domain lifecycle management journey starts with a business stakeholder who requires a new domain registration – the Originator.

Originators include sales, marketing, product management, intellectual property/brand protection, and other stakeholders. To make sound decisions and prevent errors and omissions along the lifecycle of a domain journey the domain origination process should adhere to a policy but rarely is it monitored for enforcement. The “Approver” role evaluates and decides upon the originator’s request and processes the domain registration.

Once the domain is registered, IT takes over and DNS edits begin until the day, possibly years later, when someone decides it’s time to let that domain expire. What sounds simple is not so. It’s a complex and painful process. Lacking change management systems or clear lifecycle ownership, organizations rely on email threads, a central ticketing system or perhaps a SharePoint “front-end.” Few such processes include an audit record or history of an original domain request or tools to manage DNS security policies. Years after a domain was initially registered, who knows why it was registered or what potential exposures exist on the DNS?

The domain management lifecycle starts with a business originator, but IT owns at least 80% of the journey thereafter.

Effective management of domains, the DNS and associated security for a portfolio of hundreds to thousands of domains can be painful. IT is often operationally siloed from other business groups and domain stakeholders in an organization. Network operations and IT security staff typically operate separately. This creates challenges around clear ownership and responsibility. Grey lines on control, security, and compliance ownership create ideal opportunities for nefarious actors looking for security gaps.

The domain management lifecycle starts with a business originator, but IT owns at least 80% of the journey thereafter.

Effective management of domains, the DNS and associated security for a portfolio of hundreds to thousands of domains can be painful. IT is often operationally siloed from other business groups and domain stakeholders in an organization. Network operations and IT security staff typically operate separately. This creates challenges around clear ownership and responsibility. Grey lines on control, security, and compliance ownership create ideal opportunities for nefarious actors looking for security gaps.

Large portfolios with years – even decades of accumulated legacy domains and DNS configurations create governance and compliance pain for the organization that grows over time.

Domain portfolio governance is a necessary process of continually examining every domain registered by the organization to determine whether it should be renewed or expired upon its registration anniversary date. When hundreds or thousands of domains are involved, expiring monthly on contract terms ranging between one and ten years, it can become a painful and costlyarea to manage . Without an end-to-end change management system with tamper-proof historical data and audit reports, domain stakeholders have a difficult time knowing which domains are necessary vs. those that can be discarded. Most organizations simply keep domains indefinitely, which creates problems. The bottom line is that if you own a domain you need to manage it. Failure to do so exposes the business to security risk and compliance gaps.

In the absence of an automated DNS management system, necessary domain, DNS zone file, and security settings become manual exercises. Manual audits are laborious and costly. Few enterprises comprehensively examine and report the status of each domain, subdomain, domain redirect, and their associated DNS zone files. A complete audit should minimally answer:

1. Does every domain in the portfolio have SoA (start of authority) to mitigate hijacking?
2. Is SPF, DMARC and DNNSSEC correctly configured on every domain?
3. Is there a valid TLS certificate on every domain and redirect?
4. Is the portfolio free from HTTP 400-series response codes?
5. Are all resource records checked for orphaned settings that point to unmanaged servers?
6. Is there a tamper-proof record of change activity for each domain and DNS setting?

Whether manually conducted or automated via modern control systems, audits are a necessary governance task. Manual audits are insufficient and come with a significant IT cost burden. However, if not done, the business accepts the compliance gap and security exposure.

The true cost of ownership of domains and the DNS has multiplied since the 1990s. Organizations tempted to reduce TCO by skipping essential governance tasks such as domain/DNS audits expose the organization to unacceptable security risk. Domains accumulate in over-sized, bloated portfolios. Subdomains and redirection domains expand the corporate digital footprint further, requiring increased, ongoing management and governance. All of this burdens IT, digital, product, infoSec, network operations and other stakeholders with increased work effort.

Effectively managing the domain lifecycle is inefficient and labor-intensive driving unnecessarily high Total Cost of Ownership for domain portfolios.

The domain management lifecycle spans multiple stakeholder roles across years of domain ownership. Over time this area has become increasingly complex. Nefarious actors have recognized that the DNS is a weak point in corporate IT security that is relatively easily compromised.

Only an end-to-end change management system can reliably establish visibility and control over every domain, related DNS hygiene, TLS certificates and DNS security settings to improve enterprise security, compliance, and performance. Essential capabilities of an effective change management system must minimally include:

1. Integration between a single, enterprise-grade domain registrar and a primary DNS service, plus secondary backup DNS service
2. Access to domain and DNS change management; hierarchically permissioned by approved role and password-secured using MFA or SSO
3. A tamper-proof audit log of every change by user
4. Automatic communication of all changes to designated management via alerts

Most importantly, the change management system must provide a fully integrated “single pane of glass” view of not only the domain portfolio, but all ancillary services: DNS values, TLS certificates, and all DNS security settings. Extreme ease of use to all stakeholders is essential to promote no-exceptions usership, and 100% error-free compliance.

By placing all domain and DNS-related change management operations under a single control system, domain lifecycle management becomes pain-free. Compliance is automatically enforced via a rules-based system, eliminating human error. Error detection and automatic remediation reduces labor while ensuring flawless domain and DNS operations. System-generated reports such as DNS traffic by domain can help management identify unnecessary domains to reduce overall portfolio size.

Authentic Web is a solutions provider bringing together in a single control system, approval workflow, compliance audit, domain registrar, DNS, and TLS management all dedicated to helping enterprise domain stakeholders.