DNS Security Risks: Protecting Your Enterprise Digital Identity

Executive summary

This briefing paper from Authentic Web gives context and evidence on the material risks medium and large enterprises face when proactive DNS security controls are not prioritized. It is written for information security, infrastructure and compliance executives, who often do not fully understand how heavily the business relies on external DNS, or how much threat actors use it as a foundational upstream dependency in modern attack chains.

DNS trust relationships frequently outlive infrastructure lifecycle management. Now, with automated AI-driven discovery and exploitability at scale, addressing DNS attack surface gaps has become urgent.

Peter LaMantia, CEO, Authentic Web Inc.

Key takeaways

• Enterprises are exposed because of fragmented DNS governance, incomplete visibility and weak DNS hygiene. DNS hygiene means the practices used to inventory, validate, secure, monitor and retire domains, DNS records, delegations, cloud references and trust relationships through their lifecycle.
• External DNS attacks are not theoretical: most organizations in surveys had DNS-related attacks with significant financial impact, customer-facing outages can cost millions, and phishing and credential attacks that abuse domain impersonation or weak email authentication remain among the costliest breach vectors.
• Many DNS-enabled compromises are blamed on other systems, which the paper calls the “attribution mirage”.
• The paper reviews 10 public incidents and research cases. Recurring root causes are orphaned DNS records, missing SPF and DMARC records, registrar and DNS provider exposure, and a lack of monitoring and control.

Do you have DNS exposure? Eight governance questions

1. Does the company have clear governance and oversight (GRC) over domains and DNS?
2. Does any team have full visibility and change control across the entire external DNS attack surface?
3. Do you monitor DNS vulnerabilities across all domains, including brand protection and parked domains?
4. Do you use multiple registrars and DNS providers without centralized visibility and control?
5. Is least-privilege access enforced with full auditability?
6. After M&A, has domain and DNS consolidation been executed?
7. Does the company rely on retail or SMB-grade registrars with high social-engineering exposure?
8. Are DNS controls part of cybersecurity, infrastructure and compliance programs?

Recommendations

1. Prioritize external DNS attack surface governance in cybersecurity programs.
2. Consolidate domains and DNS to an enterprise-grade provider with visibility, vulnerability detection and a unified change-control plane.
3. Establish a reporting cadence to maintain DNS security posture maturity.

Hidden DNS risk exposure: the attribution mirage

Many DNS-related compromises are misattributed to downstream systems. The incidents in this paper are DNS-attributed and are a small sample of publicly disclosed events; many more involve DNS as a root cause but are never attributed to it. DNS enables attacks but is not the system named in the final incident report. Attackers exploit hygiene gaps such as orphaned subdomains, dangling CNAMEs, forgotten cloud resources and incomplete SPF and DMARC coverage. These create hidden trust paths for phishing, malware delivery and credential harvesting, so incidents look like application, cloud or identity failures and DNS stays hidden as the starting point.

That limits prevention. With proper DNS hygiene and lifecycle controls, the exposed endpoint or trust relationship would likely have been reduced or removed. DNS also sits upstream of many traditional security visibility controls: endpoint, application, IAM, SIEM telemetry and network traffic.

Attackers use DNS for	The breach is then attributed to
Reconnaissance, infrastructure discovery, phishing domain impersonation, command-and-control routing, subdomain takeover, TLS trust exploitation	An email compromise, cloud compromise, SaaS breach, web application vulnerability or identity compromise

Examples of misclassification in post-mortems: a dangling CNAME takeover recorded as a “cloud infrastructure or application compromise”; SPF and DMARC gaps recorded as “email fraud”; a malicious redirect through abandoned infrastructure recorded as a “web application vulnerability”. In each, DNS governance and lifecycle weaknesses materially contributed.

Real-world external DNS and domain compromise incidents

These cases show DNS trust failures being exploited across sectors, often without compromising internal infrastructure.

Brazilian bank DNS hijack (full digital takeover)

Type: large-scale DNS hijacking plus phishing. What happened: attackers altered DNS for 36 domains, redirecting to fake banking sites. Impact: full interception of customer logins, cards and credentials; the entire online banking presence hijacked for about 5 hours; valid HTTPS served on the fraudulent site, increasing user trust; financial theft and fraud exposure (losses not publicly disclosed); reputational damage and regulatory exposure. Source: Wired.

“Sea Turtle” campaign (nation-state DNS hijacking)

Type: registrar and DNS infrastructure hijacking. Targets: 40 organizations, including ISPs, government and registrars. Impact: interception of sensitive email and web traffic, long-term espionage and credential theft, and proof of systemic registrar and provider compromise risk. Insight: DNS infrastructure and registrars are part of the supply chain attack surface. Source: Wired and Cisco.

MyEtherWallet

Type: BGP and DNS hijack combined with phishing. What happened: users were redirected to a fake wallet site. Impact: about $150,000 stolen directly from users and severe, immediate trust damage across the crypto ecosystem. Source: Indusface.

“Sitting Ducks” DNS vulnerability

Type: DNS misconfiguration exploited through a DNS delegation weakness. What happened: according to research, 30,000+ domains were hijacked, many from large companies. Impact: domains reused for scams and malware. Source: CSO Online.

Microsoft subdomain takeover exposure research (not an exploitation)

Type: dangling DNS and subdomain takeover exposure. What happened: researchers identified hundreds of Microsoft-owned subdomains as vulnerable because dangling DNS records pointed at decommissioned resources, including properties of microsoft.com, skype.com, windows.com and visualstudio.com. Potential impact: phishing and malware hosting from trusted Microsoft subdomains, credential harvesting, and abuse of browser and enterprise trust. Source: Sophos, Security Affairs and Microsoft guidance.

GoDaddy dormant DNS delegation exploitation

Type: orphaned or lame delegation. What happened: attackers reportedly exploited dormant domains still delegated to GoDaddy nameservers. The domains reportedly lacked properly maintained authoritative DNS configurations, and weak provisioning let malicious entries be added to delegated but unmaintained domains. Impact: many companies were affected, including Mozilla, Expedia and Yelp; hijacked trusted domains were used for spam, malware, phishing and malicious redirects; email trust and reputation suffered. Insight: orphaned DNS or lame delegations plus incomplete lifecycle governance can create exploitable trust without compromising enterprise infrastructure, so domain owners need their own DNS hygiene visibility and controls. Source: Ars Technica and Spamhaus.

Hazy Hawk dangling DNS campaign

Type: dangling DNS and abandoned cloud resource takeover. What happened: threat actors exploited dangling DNS records tied to abandoned cloud infrastructure and hijacked trusted subdomains of major organizations, using forgotten CNAMEs to cloud resources the organizations no longer controlled. Affected organizations reportedly included Panasonic, Bose, the CDC and Deloitte. Impact: malware and scams delivered from legitimate enterprise subdomains, browser trust exploitation, and persistent phishing and malicious redirect capability. Source: TechRadar, Infoblox and SecurityWeek.

Azure DevOps subdomain takeover

Type: dangling DNS and cloud service takeover. What happened: researchers demonstrated takeover of abandoned Azure DevOps-linked subdomains whose DNS records still pointed to decommissioned cloud resources. Potential impact: credential theft, abuse of trusted Microsoft infrastructure relationships and downstream compromise of CI/CD and DevOps trust chains. Insight: DNS records outlive the cloud apps and DevOps infrastructure they point to. Source: Binary Security.

Windows Live Tiles Azure takeover (research proof of concept, not an exploitation)

Type: dangling DNS and cloud resource hijack. What happened: a researcher demonstrated takeover of a Microsoft-owned Windows Live Tiles subdomain through an Azure cloud service weakness, using DNS references to unclaimed cloud infrastructure. Potential impact: attacker-controlled content served from a trusted Microsoft property, phishing and malware delivery risk, and abuse of Microsoft branding and browser trust. Source: The Hacker News.

What these cases prove

1. It happens to mature Tier-1 brands. The cases include a Brazilian bank, Microsoft, Mozilla, Expedia, Yelp, Deloitte, PwC, EY, the CDC, Panasonic and Bose, and more enterprise domains were reportedly affected. Even highly mature organizations accumulate DNS lifecycle gaps.
2. Many DNS attacks need no infrastructure or application compromise. Recurring causes: orphaned DNS records, missing SPF and DMARC records, registrar and DNS provider exposure, lack of monitoring, visibility and controls, and unmanaged third-party or supply chain dependencies.
3. Brand trust and reputation take the hit. Customers gave credentials to attackers, malware was distributed under trusted domains, and money was stolen directly (crypto, banking).
4. DNS is upstream of most enterprise security systems. DNS manipulation routes users to attacker infrastructure before IAM, EDR, WAF or Zero Trust controls act. DNS governance belongs in external attack surface management, supply chain risk management and digital identity assurance.

Why DNS governance gaps persist in large enterprises

Enterprises do not neglect DNS security on purpose; the problem is structural and builds up through complexity: mergers and acquisitions, legacy applications, cloud migrations, expired projects and abandoned infrastructure, decentralized SaaS adoption, siloed operations and systems, shadow IT, no central DNS visibility and control plane, multiple registrars and DNS providers, and external agencies and vendors.

Over time DNS sprawl accumulates: records outlive applications, delegations outlive ownership, cloud resources are retired without DNS cleanup, subdomains stay trusted long after anyone oversees them, records are added freely and rarely removed, and team turnover loses knowledge. Siloed ownership and tooling prevent a unified view:

• No single team owns the entire external DNS attack surface, and visibility is fragmented across infrastructure, networking, cloud, security and application teams.
• Security tooling focuses on endpoints, identities, applications and internal telemetry, not external DNS trust relationships.
• External DNS is treated as infrastructure only, not as an attack surface, and domain and DNS management is seen as overhead rather than strategic security infrastructure.

The result is unmanaged risk: orphaned DNS records and dangling CNAMEs, lame delegations, insecure trust relationships (HTTP-only transport or weak TLS trust), expired cloud resource connections, weak registrar and DNS change controls, and incomplete email authentication and reporting (SPF and DMARC). That is why organizations with mature security programs are still exposed to hidden DNS-enabled compromises.

Closing insights and summary

Compromise paths can start upstream of applications and downstream security controls, through DNS, registrar or infrastructure trust weaknesses. As enterprises depend more on cloud, SaaS and digital identity trust, DNS governance becomes a concern for operational resilience and compliance. Organizations lacking these capabilities face material DNS-enabled risk:

• A complete domain and DNS inventory.
• Verified ownership and change control.
• Automated detection of orphaned and dangling assets.
• Continuous DNS and web monitoring.
• An enforced DNS lifecycle policy.

Without these controls, attackers can compromise your brand identity without touching internal systems. DNS is the enterprise’s public identity layer, yet remains one of the least governed and least visible parts of the attack surface. As regulators, insurers and enterprise customers increasingly assess operational resilience and third-party security governance, unmanaged DNS attack surface exposure becomes a governance and accountability concern. The paper’s closing statement: enterprises need centralized visibility, control-plane systems and lifecycle management to reach a mature DNS security posture.

Appendix: types of DNS compromise

Type	How it works	Outcomes and impacts
Domain hijacking and registrar compromise	Domain hijacking through social engineering at registrars, often via large call center operations.	Traffic redirection, credential harvesting, email interception (MX changes), phishing hosted on a legitimate domain, financial loss and regulatory exposure.
Third-party DNS or registrar compromise (enterprise risk)	Domain and DNS compromise increasingly involves vendors, SaaS providers, registrars or DNS providers.	Domain transfers and ownership changes, DNS record modification, supply chain compromise, long-term brand erosion.
Dangling DNS and subdomain takeover	Abandoned SaaS or cloud resources are taken over to serve malicious content under a trusted domain.	Credential harvesting, phishing on legitimate subdomains, malware hosting under trusted brands.
Man-in-the-middle via DNS control	DNS hijack gives traffic interception without direct compromise of the application layer.	Session hijacking, SSL certificate abuse (as seen in the bank case), trust exploitation at scale.
Email interception via DNS (MX manipulation)	Attackers modify MX records to receive corporate email.	Business email compromise (BEC) fraud, invoice redirection, insider impersonation.
DNS-enabled phishing (SPF and DMARC failures)	Phishing via domain abuse where SPF and DMARC records are not in place across all domains.	Spoofed email domains, customer credential theft or malware infection, BEC. Average phishing-related breach cost $4.76M (IBM). The paper says it drives the majority of cyber insurance claims, with billions in total losses, and long-term loss of trust in communications.

Sources

• NIST, Secure Domain Name System (SP 800-81r3)
• Cisco Talos, Sea Turtle
• EfficientIP, IDC Global DNS Threat Report
• Authentic Web, 2026 Board Mandates: Proving Digital Identity Control
• Also cited (add URLs from the source file): CISA DNS security guidance; Center for Cybersecurity Policy; Microsoft subdomain takeover guidance; Atlassian cost of downtime; Sophos; OWASP subdomain takeover testing; Security Affairs; Infoblox research on Sitting Ducks; The Hacker News; IBM Cost of a Data Breach; SecurityWeek; KrebsOnSecurity; Binary Security; SecurityScorecard; Spamhaus; Ars Technica; TechRadar; Wired; Indusface; CSO Online.