DNS Security Glossary
The terms you will meet when securing a network with DNS.
- DNS
- Domain Name System: translates domain names into IP addresses.
- DNS Firewall
- A resolver that refuses to answer for malicious or unwanted domains.
- Resolver
- The server that looks up DNS answers on behalf of your devices.
- DNS over HTTPS (DoH)
- Encrypted DNS sent inside HTTPS on port 443.
- DNS over TLS (DoT)
- Encrypted DNS on port 853.
- NXDOMAIN
- A DNS answer meaning the domain does not exist; used to block lookups.
- 0.0.0.0 sinkhole
- Answering a blocked domain with a non-routable address so connections fail instantly.
- RDAP
- Registration Data Access Protocol: the modern WHOIS, used to find domain age.
- Newly Registered Domain
- A domain created recently, commonly used in phishing and malware.
- TLD
- Top-level domain, the last part of a name such as .com, .se or .xyz.
- Phishing
- Fake sites or messages designed to steal credentials or money.
- C2 server
- Command-and-control server that malware contacts for instructions.
- DGA
- Domain generation algorithm: malware creating many random domains to evade blocklists.
- DNS Tunneling
- Hiding data inside DNS queries to bypass security controls.
- DNS Rebinding
- An attack that switches a domain to a private IP to reach local devices.
- Allowlist
- Domains that are always permitted, overriding block rules.
- Blocklist
- Domains that are always blocked.
- SafeSearch
- Search engine filtering of explicit results, enforceable via DNS.
- TTL
- Time to live: how long a DNS answer may be cached.
- Open Resolver
- A DNS server that answers anyone, often abused for amplification attacks.
- Typosquatting
- Registering misspelled brand domains to trick users.
- Protective DNS
- Government and industry term for security-focused DNS filtering.
Put these terms into practice with the setup guides, read the blog or the FAQ.