DNS: Enterprise Architecture

April 15, 2026·3 min read·591 words

DNS (Domain Name System) is the most invisible yet most critical service. Without DNS, nothing works. This guide covers enterprise DNS architecture: internal and external resolvers, Split-Horizon DNS, DNSSEC, DNS over HTTPS, SASE DNS filtering, monitoring, and security.

Enterprise DNS Architecture

Internal Resolvers

AD DNS (Windows Server): integrated with Active Directory and used by 95% of Windows-based enterprises
BIND (ISC open source): powerful, long-established standard
PowerDNS: modern, with a native REST API
Unbound: DNSSEC-validating recursive resolver
Infoblox DDI: commercial unified DNS + DHCP + IPAM solution

External Recursive Resolvers

Configuration: 2+ internal DNS servers configured through DHCP
Internet forwarders: Google 8.8.8.8, Cloudflare 1.1.1.1, Quad9 9.9.9.9
Recommendation: do not forward directly; use DNS filtering services such as Umbrella, Netskope, or AdGuard

Split-Horizon DNS

Internal and external clients receive different resolutions:

External www.entreprise.fr: 203.0.113.10 (public web server)
Internal www.entreprise.fr: 10.0.0.10 (internal web server)
Configuration: 2 separate DNS zones (internal + external)
Purpose: avoid hairpinning (internal user → FW → external network → back to the internal network)

DNS Records

A: host → IPv4
AAAA: host → IPv6
CNAME: alias pointing to another hostname
MX: mail server (priority + host)
TXT: free-form text (SPF, DKIM, DMARC, site verification)
SRV: service location (LDAP, SIP, Kerberos)
NS: authoritative nameserver for the zone
PTR: reverse lookup (IP → hostname)
SOA: Start of Authority (master, administrator email, serial, refresh)
CAA: Certificate Authority Authorization (which CAs may issue certificates for the domain)

DNSSEC

DNS Security Extensions: cryptographic signatures for records to prevent DNS spoofing:

Additional records: RRSIG, DNSKEY, DS, NSEC, NSEC3
Validation: the resolver verifies the signature chain up to the root
Deployment: .fr has been signed since 2010 and .com since 2011
Actual adoption: ~30% of domains are signed, with adoption growing due to NIS2
Risk without DNSSEC: cache-poisoning attacks (Kaminsky 2008)

DNS over HTTPS / TLS

DoT (DNS over TLS, RFC 7858): port 853
DoH (DNS over HTTPS, RFC 8484): port 443, difficult to filter
Use case: Firefox enables DoH by default → bypassing enterprise filters!
Solution: enforce local DNS through GPO and block external DoT/DoH traffic
DDR (Discovery of Designated Resolvers): automatic DoH/DoT configuration by the resolver

DNS Filtering (SASE/SSE)

An essential component of modern security:

Cisco Umbrella: DNS filtering + threat intelligence (~€4/user/month)
Cloudflare Gateway: free tier available + DoH
Netskope: integrated with SSE
Blocked categories: malware, phishing, C2, P2P, crypto mining
ThreatCloud integration: real-time blocking of malicious domains

DNS Monitoring

Query volume by user/subnet (anomaly detection)
Newly registered domains (NRDs): phishing/malware indicator
DGA (Domain Generation Algorithm): detection of domains generated by malware
DNS tunneling: data exfiltration through long DNS queries
Tools: PowerDNS dnsmonster, BIND query logs + Splunk, Cisco Umbrella Investigate

DNS in Windows AD

AD-integrated zones: stored in AD and replicated through DS replication
Secure Dynamic Updates: only AD clients can update records
Scavenging: removal of stale records (7 days by default)
Critical SRV records: _ldap._tcp.dc._msdcs, _kerberos._tcp
Reverse zones are required for Kerberos

Best Practices

Minimum of 2 DNS servers per site (primary + secondary)
Deploy a secondary server at a remote site/campus for DR
Real-time monitoring (PRTG, Zabbix, Grafana)
DNSSEC for external domains (mandatory under NIS2)
Mandatory DNS filtering (SASE)
Block external DoH/DoT traffic (port 853, pattern detection)
Audit logging: retain all DNS queries for 90+ days

Troubleshooting

nslookup, dig, drill: basic testing
dig +trace google.com: follows the DNS hierarchy
dig @8.8.8.8 example.com ANY: queries a specific resolver
Wireshark ports 53 + 853: packet capture
Pi-hole, AdGuard Home: self-hosted resolvers + analytics

Order from OPTINOC

Enterprise DNS architecture: BIND/Kea/Infoblox/Windows DNS, DNSSEC, and SASE integration (Cisco Umbrella, Cloudflare, Netskope). Quote within 48 hours.