Overview: DNS security and compliance in the retail sector
Retail is a top target for cyber criminals in part because its networks and data are exposed on the DNS. Authentic Web’s retail-sector DNS security audit found non-compliance in IT controls across many InfoSec frameworks. This paper, by Peter LaMantia, CEO of Authentic Web Inc., helps teams identify and remediate these security risks and compliance gaps.
Key findings from the benchmark
Sample: 25 medium to large retail brands in the USA, Canada and the UK; 20,484 domains; 79,531 resource records.
- 23.6% of A records fail the HTTP/HTTPS scan (5,760 of 24,440).
- 47.2% of redirects fail (4,820 of 10,216): almost half are insecure or exposed.
- 15.3% of CNAMEs fail (1,440 of 9,412), exposing them to takeover or phishing with the brand’s own domains.
- 8.9% of domains have lame delegations (1,820 of 20,484).
- About 59% of domains lack a valid SPF record or fail the standard, about 68.5% lack a valid DMARC record or fail the standard, and 98.9% of domains are not DNSSEC-signed.
Purpose of the paper
The paper examines external DNS management as a known and under-addressed vulnerability among retail enterprises. Its observations:
- The DNS is a principal attack vector, enabling cyber-attackers.
- Compliance standards for external DNS management are inconsistently followed.
- DNS management best practices can mitigate retail-sector cyber-risk.
Credit card data is the new currency for hackers and criminals, and retailers possess a lot of it. This makes the retail industry an almost irresistible target for cyber-attacks.
Global Cyber Executive Briefing, Retail, Deloitte
The state of threats and compliance in retail
Few sectors are as focused on IT security compliance as retail. It is a goldmine of sensitive consumer data intersecting with payment authorities, supply chain partners and other stakeholders.
Retail ranks among the five most cyber-attacked sectors, with one ranking naming it the most cyber-attacked sector in 2019. According to Fortinet, 24% of cyberattacks target retailers: “Given the wealth of payment information retailers have access to, it is no surprise that nearly a quarter, 24%, of all cyberattacks (target) retailers. Retailers often have varying levels of security, leaving them exposed to cyber criminals.”
IT security compliance standards in retail
Despite the many frameworks retail organizations follow (NIST, CIS Controls, COBIT, PCI DSS, SOC 2 Type 2, ISO, Cloud Security Alliance), retailers remain a perennial target for ransomware, data exfiltration and phishing. The paper gives two reasons:
- Most security frameworks do not explicitly call out domain and DNS governance, yet all require full change controls over critical infrastructure. DNS networks are critical infrastructure.
- Many senior security executives the authors interviewed admit to operational gaps in applying framework standards specifically to domains and the DNS.
Security frameworks and the DNS
Managing external domains and DNS controls is not prescriptively specified in all security frameworks, but the relevant themes are clear. CIS18, SOC 2, PCI, NIST, GDPR and HITRUST CSF contain standards pertinent to domains and the DNS:
| Framework standard | What it requires | Domain and DNS applicability |
|---|---|---|
| 1. IT controls and user access controls | Only authorized individuals and systems have appropriate access to critical company assets and systems. | Domains and DNS are mission-critical network assets and systems. |
| 2. Logging, audits, audit management, auditability | Track and report all activity related to interaction with company assets, networks, security information, monitoring. | Domain and DNS change history and change reporting required. |
| 3. Change management | Any material change to systems and assets needs to go through a change management control process. | Change workflow required to edit domain and DNS records. |
| 4. Monitoring for vulnerabilities | All known cyber-attack vectors need to be actively monitored, remediated and reported. | Systems to identify and monitor DNS-specific attack vectors. |
| 5. Backup, recovery and availability of critical systems | Companies need to be able to back up and restore key systems and information to ensure business continuity. | Secondary DNS and zone file backups are required. |
| 6. Network security | No unauthorized or unmanaged access to any company networking systems. | Includes external DNS and domains. |
Conclusion. If retail organizations do not apply InfoSec framework requirements to their management of domain assets and DNS network, they will fail compliance audits and greatly increase their exposure to known security threats that continue to play out in the sector.
The persistent external DNS security risk
External DNS networks: the soft underbelly of InfoSec
External DNS management is widely acknowledged as a principal source of cyber-breaches and data loss in retail and other sectors. The DNS is a publicly accessible network that cyber criminals use to discover and exploit enterprise and customer data. Compliance for DNS management is inconsistently covered by the eight most important security frameworks used in retail: references to external DNS management range from explicit (NIST, ISO and CIS) to indirect (PCI DSS, GDPR and SOC 2).
A study by Efficient IP and IDC (2022) found that 73% of respondents say DNS security is critical.
Why the DNS is retail’s primary attack vector
- Multiple domain registrars and managed DNS providers. Retailers often own hundreds of domains registered across multiple registrars and managed DNS provider services.
- Lack of clear ownership. Internal ownership of domain assets and DNS is split across network infrastructure, legal (IP), IT security, operations and marketing.
- Complex, decentralized management. Domains, zone file records and DNS security configurations are typically not centrally managed, governed for compliance or monitored.
The global DNS is also publicly accessible, and dangerously so: unlike internal networks, the external DNS can be viewed, probed and exploited by external parties.
DNS security consequences
The smallest misconfigurations can expose retail organizations: an insecure redirect chain to the destination, orphaned A records and dangling CNAMEs, and missing or misconfigured DNS settings such as SPF, DMARC, DNSSEC and DKIM. Malicious parties scan constantly for these gaps to run man-in-the-middle exploits, domain hijacking, DNS cache poisoning, takeover of orphaned A record and CNAME endpoints, and phishing scams using retailers’ own domains.
How and why DNS management is non-compliant in retail
Vendor fragmentation in the domain and managed DNS space has left this area without robust, compliant change management. Domain and DNS management is often the exception to retailers’ security compliance in other IT and network areas. External DNS management often lacks:
- Role-based, permissioned access to DNS change management.
- Tamper-proof logging of changes and auditable change reports.
- Correctly configured and monitored DNS security settings.
- MFA or single sign-on access controls across all vendor systems.
- Network asset and endpoint visibility and governance.
Retail mergers and acquisitions make matters worse
Every time a retail organization buys a company, it also acquires the latent security issues in the target’s domain assets and DNS network. These issues are notoriously difficult to identify, and due diligence rarely determines the full security posture of target domain and DNS assets. Serial M&A, the strategic aim of many large retailers, compounds the risk as newly acquired DNS operations accumulate without complete integration. Best-practice responses:
- Always conduct a thorough external audit of target domain assets and DNS networks.
- Consolidate acquired assets to a single domain registrar and managed DNS provider.
- Place all acquired assets under a unified, compliant change management system.
Four best practice recommendations
1. Benchmark your DNS security posture with a domain and DNS security audit
Audits confirm that every organization has security gaps in its domain assets, zone files and DNS security settings. Internal audits that retailers run themselves are manual, costly and rarely complete. Retail organizations believe their external DNS is compliant. It is not.
2. Consolidate domains and DNS to a single registrar and managed DNS service provider
Multiple, non-integrated administrative controls for each service make critical domain, DNS and TLS certificate details less visible to stakeholders and harder to manage. Retailers believe their domain assets and DNS are locked down. They are not.
3. Place domains, DNS and TLS certificates under a standards-compliant change management system
ISO/IEC, NIST and CIS demand role-based, permissioned access controls and a tamper-proof audit history of all access and change activity. Few retail organizations follow these measures in domain and DNS management, even though they are standards-compliant in most of their network operations.
4. Place domains and DNS assets under a DNS-specific security inspection and monitoring system
New vulnerabilities can surface at any time from internal staff and from the ongoing efforts of unauthorized external parties, so DNS security must be monitored continually. Retail organizations’ DNS security posture demands constant, ongoing framework compliance.
Appendix: Retail DNS Security and Compliance Benchmark Report 2024
An industry-wide assessment of external DNS security posture, powered by DNS Inspector. Failure to maintain good DNS hygiene, enforce DNS security policies and govern change management makes enterprises non-compliant with frameworks such as HIPAA, SOC 2 and ISO, exposing them to network and data vulnerabilities. Effective infrastructure managers understand that a strong DNS security and compliance posture is the foundation for well-run infrastructure and systems operations.
Methodology
Authentic Web selected a representative sample of 25 medium to large retail brands across the USA, Canada and the UK, with average revenues of $24B (range $665M to $245B). Using DNS Inspector’s domain and DNS discovery, cross-referenced with WHOIS and IT infrastructure data, it identified 20,484 domains used by the sample organizations. It catalogued the zone file of each domain, capturing 79,531 resource records, and scanned them for DNS network vulnerabilities. Steps: (1) domain discovery from the brand, WHOIS and infrastructure to a domain list; (2) zone discovery of A records, CNAMEs and related records; (3) infrastructure and vulnerability audit through the DNS Inspector interface.
Benchmark study scope
| Item | Number | Ratio |
|---|---|---|
| Total domains | 20,484 | 819 domains per entity |
| Total records analyzed | 79,531 | 3.88 records per domain |
| Total A records | 24,440 | 1.19 per domain |
| Total CNAMEs | 9,412 | 0.46 per domain |
| Total redirects | 10,216 | 0.50 per domain |
| SPF records | 8,326 | 0.41 per domain |
| DMARC records | 6,434 | 0.31 per domain |
| DNSSEC signatures | 223 | 0.01 per domain |
Domain registrars. The domains use 297 unique registrars; the top 10 account for 12,948 domains (63%).
| Registrar | Domains |
|---|---|
| Network Solutions | 4,568 |
| CSC | 2,355 |
| Directi Internet | 1,566 |
| MarkMonitor | 1,356 |
| Tucows/Enom | 1,138 |
| Key-Systems | 571 |
| Safenames | 394 |
| Com Laude | 379 |
| GoDaddy | 341 |
| NameCheap | 280 |
| Top 10 total | 12,948 (63%) |
DNS providers. The domains use 185 unique DNS providers; the top 10 account for 16,599 domains (81%).
| DNS provider | Domains |
|---|---|
| RIPE | 3,040 |
| GoDaddy | 3,010 |
| Network Solutions | 2,710 |
| Cloudflare | 2,554 |
| Vercara | 1,982 |
| Amazon | 771 |
| APNIC | 712 |
| 706 | |
| NSONE | 571 |
| Microsoft | 543 |
| Top 10 total | 16,599 (81%) |
Top-level domains. 88% of the domains are on legacy TLDs, and 73% of all domains audited are .com.
| TLD type | Domains | Share of total |
|---|---|---|
| Legacy | 18,120 | 88.5% |
| Country code | 1,208 | 5.9% |
| New | 1,158 | 5.7% |
| Total | 20,484 |
DNS vulnerabilities explained
The DNS is used in nearly every cyberattack. Because it is a global public network, it exposes enterprise vulnerabilities to any party motivated to look.
| Vulnerability | What it is | How it is used in an attack |
|---|---|---|
| Orphaned IPs | A records pointing to IPs not under the control of enterprise infrastructure and monitored by endpoint vulnerability systems. | Loss of control of an IP on a shared web service such as AWS creates an attack vector: a third party can take the IP over. |
| Dangling CNAMEs | CNAMEs pointing to a web resource or host not under enterprise control and monitored. | A third party can create the host name the CNAME points to, enabling any type of attack. |
| Insecure redirects | One or more hops to a URL destination is unencrypted (HTTP only). | Encryption gaps permit a man-in-the-middle exploit used to compromise audiences navigating from origin to destination. |
| Lame delegations | A domain has no Start of Authority (SOA) record on the DNS service that governs DNS create and edit control for the domain. | Permits creation of an SOA record on the DNS service to assume full control over the DNS for that domain. |
| SPF and DMARC coverage and errors | Records do not conform to RFCs, or SPF and DMARC records are missing. | Nonconforming or missing records enable phishing attacks. |
| DNSSEC coverage gaps | DNSSEC is not present or not configured correctly. Some organizations resist it because of perceived key-roll risk. | DNSSEC addresses DNS cache poisoning of recursive servers, which can lead to man-in-the-middle exposure. |
Benchmark vulnerability results
| Check | Headline | Pass | Warn | Fail |
|---|---|---|---|---|
| A records (24,440) | 23.6% fail | 7,750 | 10,930 | 5,760 |
| Redirects (10,216) | 47.2% fail | 4,520 | 876 | 4,820 |
| CNAMEs (9,412) | 15.3% fail | 7,940 | none shown | 1,440 |
| Lame delegations (20,484 domains) | 8.9% | 18,660 | none | 1,820 |
| SPF (20,484 domains) | 59.9% (body text: 59.4%) | 8,220 | 12,150 | 106 |
| DMARC (20,484 domains) | 68.7% (body text: 68.5%) | 6,410 | 14,040 | about 30 (not labelled) |
| DNSSEC (20,484 domains) | 98.9% not signed | 223 | 20,260 | none |
Chart counts are as labelled in the pie charts (values given in thousands, rounded). What each check means:
- A records. The HTTP/HTTPS scan identifies potential vulnerabilities including orphaned IPs, insecure connections and deprecated TLS versions. Some responses are legacy settings to deprovision and others are acceptable internal-only by design, so teams investigate each record and classify the risk as material or not.
- Redirects. Every redirect must carry certificates from the origin domain through to the destination URL for end-to-end encryption. Other exposures include an excessive number of hops, or orphaned records pointing to resources the company no longer controls.
- CNAMEs. The scan identifies all CNAME destinations and dangling CNAMEs. IT teams configure CNAMEs for specific purposes; when the purpose ends the destination is deprovisioned but the CNAME is left, vulnerable to takeover or phishing using your own domains.
- Lame delegations. Without a valid SOA record, parties can create an illegitimate SOA on the DNS network where the domain is hosted and hijack its zone file. The paper calls 9% a very high number and evidence that legacy registrars and domain owners fail to keep domains secure, typically because they lack visibility.
- SPF. SPF records define which mail servers may send mail for a domain. Missing or failed SPF exposes the domain owner to phishing emails from their own domain, so every owned domain needs a valid SPF record.
- DMARC. DMARC works with SPF to secure email. Without it across the portfolio, phishing emails can be sent from your own domain.
- DNSSEC. DNSSEC signs a domain’s zone file cryptographically and defends against recursive server cache poisoning, preventing DNS-based man-in-the-middle attacks. Automated key rolling in modern registrar and DNS provider systems is expected to raise adoption.
Best practices and benefits of action
- Conduct a DNS security audit to gain visibility and establish your security posture.
- Consolidate domains to a single registrar and DNS provider with change control automation.
- Implement ongoing DNS configuration, security inspection and monitoring.
Benefits: keeps the company and customers safe on branded spaces; complies with infrastructure control requirements in relevant frameworks; automates the practice so teams can get and keep control; and reduces total cost of ownership through consolidation and automation, with operating efficiency and compliance controls.