DNS: Enterprise Architecture

DNS (Domain Name System) is the most invisible yet most critical service. Without DNS, nothing works. This guide covers enterprise DNS architecture: internal and external resolvers, Split-Horizon DNS, DNSSEC, DNS over HTTPS, SASE DNS filtering, monitoring, and security.

Enterprise DNS Architecture

Internal Resolvers

• AD DNS (Windows Server): integrated with Active Directory and used by 95% of Windows-based enterprises
• BIND (ISC open source): powerful, long-established standard
• PowerDNS: modern, with a native REST API
• Unbound: DNSSEC-validating recursive resolver
• Infoblox DDI: commercial unified DNS + DHCP + IPAM solution

External Recursive Resolvers

• Configuration: 2+ internal DNS servers configured through DHCP
• Internet forwarders: Google 8.8.8.8, Cloudflare 1.1.1.1, Quad9 9.9.9.9
• Recommendation: do not forward directly; use DNS filtering services such as Umbrella, Netskope, or AdGuard

Split-Horizon DNS

Internal and external clients receive different resolutions:

• External www.entreprise.fr: 203.0.113.10 (public web server)
• Internal www.entreprise.fr: 10.0.0.10 (internal web server)
• Configuration: 2 separate DNS zones (internal + external)
• Purpose: avoid hairpinning (internal user → FW → external network → back to the internal network)

DNS Records

• A: host → IPv4
• AAAA: host → IPv6
• CNAME: alias pointing to another hostname
• MX: mail server (priority + host)
• TXT: free-form text (SPF, DKIM, DMARC, site verification)
• SRV: service location (LDAP, SIP, Kerberos)
• NS: authoritative nameserver for the zone
• PTR: reverse lookup (IP → hostname)
• SOA: Start of Authority (master, administrator email, serial, refresh)
• CAA: Certificate Authority Authorization (which CAs may issue certificates for the domain)

DNSSEC

DNS Security Extensions: cryptographic signatures for records to prevent DNS spoofing:

• Additional records: RRSIG, DNSKEY, DS, NSEC, NSEC3
• Validation: the resolver verifies the signature chain up to the root
• Deployment: .fr has been signed since 2010 and .com since 2011
• Actual adoption: ~30% of domains are signed, with adoption growing due to NIS2
• Risk without DNSSEC: cache-poisoning attacks (Kaminsky 2008)

DNS over HTTPS / TLS

• DoT (DNS over TLS, RFC 7858): port 853
• DoH (DNS over HTTPS, RFC 8484): port 443, difficult to filter
• Use case: Firefox enables DoH by default → bypassing enterprise filters!
• Solution: enforce local DNS through GPO and block external DoT/DoH traffic
• DDR (Discovery of Designated Resolvers): automatic DoH/DoT configuration by the resolver

DNS Filtering (SASE/SSE)

An essential component of modern security:

• Cisco Umbrella: DNS filtering + threat intelligence (~€4/user/month)
• Cloudflare Gateway: free tier available + DoH
• Netskope: integrated with SSE
• Blocked categories: malware, phishing, C2, P2P, crypto mining
• ThreatCloud integration: real-time blocking of malicious domains

DNS Monitoring

• Query volume by user/subnet (anomaly detection)
• Newly registered domains (NRDs): phishing/malware indicator
• DGA (Domain Generation Algorithm): detection of domains generated by malware
• DNS tunneling: data exfiltration through long DNS queries
• Tools: PowerDNS dnsmonster, BIND query logs + Splunk, Cisco Umbrella Investigate

DNS in Windows AD

• AD-integrated zones: stored in AD and replicated through DS replication
• Secure Dynamic Updates: only AD clients can update records
• Scavenging: removal of stale records (7 days by default)
• Critical SRV records: _ldap._tcp.dc._msdcs, _kerberos._tcp
• Reverse zones are required for Kerberos

Best Practices

• Minimum of 2 DNS servers per site (primary + secondary)
• Deploy a secondary server at a remote site/campus for DR
• Real-time monitoring (PRTG, Zabbix, Grafana)
• DNSSEC for external domains (mandatory under NIS2)
• Mandatory DNS filtering (SASE)
• Block external DoH/DoT traffic (port 853, pattern detection)
• Audit logging: retain all DNS queries for 90+ days

Troubleshooting

• nslookup, dig, drill: basic testing
• dig +trace google.com: follows the DNS hierarchy
• dig @8.8.8.8 example.com ANY: queries a specific resolver
• Wireshark ports 53 + 853: packet capture
• Pi-hole, AdGuard Home: self-hosted resolvers + analytics

Order from OPTINOC

Enterprise DNS architecture: BIND/Kea/Infoblox/Windows DNS, DNSSEC, and SASE integration (Cisco Umbrella, Cloudflare, Netskope). Quote within 48 hours.