DNS in attacks and defence

DNS sits so early in every connection that it shows up on both sides of security: attackers rely on how domain names are chosen and resolved, and defenders use the same system to block known-bad destinations. Three uses of DNS are worth understanding on their own.

Phishing and look-alike domains

A phishing site does not need to break DNS; it just needs a domain name close enough to fool a reader in a hurry. The US Cybersecurity and Infrastructure Security Agency (CISA) describes exactly this pattern: “malicious websites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs .net).” CISA also recommends checking where a link actually points before trusting it: “if you hover your cursor over any links in the body of the email, and the links do not match the text that appears when hovering over them, the link may be spoofed.”

DNS blocking

Because a device asks a resolver before it can reach a site at all, whoever controls that resolver can quietly prevent the connection from ever starting. The Electronic Frontier Foundation explains the mechanism plainly: “an ISP can program its DNS resolver to give an incorrect answer, or no answer, whenever a user tries to look up the location of a blocked site or service.” Switching to a resolver that answers honestly can restore access, and using encrypted DNS (the previous lesson) adds another layer, since it can “prevent any network actor from seeing (and filtering) your DNS traffic.” The EFF also flags the limits of that approach: “if you are using any of the popular encrypted DNS services such as 1.1.1.1 or 8.8.8.8, be aware that governments can target these endpoints” directly.

DNS tunneling

DNS traffic is so routinely allowed through firewalls that it can be abused as a channel of its own. MITRE ATT&CK, the widely used catalogue of real-world attacker techniques, describes this as DNS tunneling: “adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.” In practice this means commands or stolen data are encoded into DNS queries and responses, which pass unnoticed among the legitimate lookups every device makes constantly. It is a technique built into an otherwise ordinary, essential protocol, which is part of why it is hard for a network to block outright.

Choosing a resolver

There is no single resolver that is simply “safe”: every choice moves visibility somewhere. Cloudflare notes that its own public resolver, 1.1.1.1, “supports both DoT and DoH”, and other public resolvers offer the same encrypted options; whichever you choose, that operator becomes the party that sees your lookups, as the earlier lesson on visibility described. A resolver that also blocks known-malicious domains can stop a lookup from ever reaching a confirmed phishing or attack domain, but it is a filter, not a guarantee that every dangerous domain will be on its list.

None of this amounts to a promise that any single setting makes a device safe: DNS is one layer among many, and determined, well-resourced attackers adapt around any single defence. Anyone facing a specific, serious threat, a journalist, an activist, someone under targeted surveillance, is better served by expert help than by a checklist. The Access Now Digital Security Helpline offers free, direct technical assistance to people and organizations at risk, and Freedom of the Press Foundation supports journalists with similar digital security guidance.