The Domain Name System (DNS) is the internet's naming directory: it translates a human-readable domain such as example.com into the IP address a device connects to. Every website visit and email delivery starts with a DNS lookup, which is why JCSS Indonesia treats DNS as a core IT general control, not a background utility.
What is the Domain Name System and what does it do?
DNS maps domain names to the data that systems need, mainly IP addresses and mail routing, so people do not have to remember numeric addresses.
The design is set out in RFC 1034, published in November 1987, which describes DNS as three parts: a tree-structured name space with its resource records, name servers that hold the data, and resolvers that query those servers for clients. The tree is read right to left. In mail.example.com, com is the top-level domain, example is the registered domain and mail is a host within it.
How does a DNS lookup actually work?
A device asks a recursive resolver, which walks the hierarchy from the root to the authoritative name server and returns the answer, usually caching it for reuse.
In practice the sequence is:
- The application asks the operating system's stub resolver for the address of a name.
- The stub resolver forwards the question to a recursive resolver, typically run by the network or an internet provider.
- If the answer is not cached, the recursive resolver asks a root server, which points it to the servers for the top-level domain.
- The top-level domain servers point to the authoritative name servers for the domain.
- The authoritative server returns the record, and the resolver caches it for the period set by the record's time to live (TTL) before replying.
Caching explains why a DNS change does not take effect everywhere at once: resolvers keep the old answer until its TTL expires.
Which DNS record types matter most?
A, CNAME, MX, NS, PTR and SOA records cover most business needs, from pointing a website to routing email and defining who is authoritative for a zone.
RFC 1034 defines these as resource record types, each carrying an owner name, type, class and TTL.
| Record | What it does | Typical control concern |
|---|---|---|
| A | Maps a name to an IPv4 address | Stale entries pointing to decommissioned servers |
| CNAME | Makes one name an alias of another | Dangling aliases to services no longer owned |
| MX | Names the mail servers for a domain | Unauthorised change redirects company email |
| NS | Lists the authoritative name servers | Delegation to a provider the company no longer controls |
| PTR | Maps an address back to a name | Mismatch with forward records |
| SOA | Start of authority: serial number and refresh, retry and expire timers | Secondary servers not synchronising |
RFC 1034 also expects each zone to be available on at least two name servers, which is the origin of the redundancy requirement most organisations now apply to authoritative DNS.
Why does DNS security matter to a business?
Whoever can alter your DNS records can redirect your website, intercept your email or impersonate your domain, so DNS integrity is a risk to revenue, data and reputation.
Typical failure modes seen in reviews are not exotic: registrar accounts without multi-factor authentication, DNS administration shared among staff who have left, forgotten records that still point at retired infrastructure, and no log of who changed what. None of these needs an attacker with advanced tools. They are access-control and change-management weaknesses, the same categories an ITGC review tests for applications and databases.
What are DNSSEC, DNS over TLS and DNS over HTTPS?
DNSSEC proves that DNS answers are authentic and unaltered, while DNS over TLS and DNS over HTTPS encrypt the query in transit. They address different problems and are complementary.
RFC 4033 introduces the DNS Security Extensions, which provide origin authentication and integrity protection for DNS data through a chain of DNSKEY and DS records from the root downward. It states that DNSSEC does not provide confidentiality. RFC 9364 records DNSSEC origin authentication as the current recommended practice.
Confidentiality comes from transport encryption: RFC 7858 specifies DNS over TLS, with servers listening on TCP port 853 by default, and RFC 8484 specifies DNS over HTTPS. Whether to enforce either inside a corporate network is a policy decision, because encrypted DNS can bypass the filtering and logging that security teams rely on.
What would an auditor check for DNS and domain controls?
An auditor checks who can change DNS, how changes are approved and logged, whether the registrar account is protected, and whether the records still match the live estate.
A practical checklist:
- Ownership: the domain is registered to the company, not an individual or former vendor, with renewals tracked and a registrar lock enabled.
- Access: named accounts, multi-factor authentication, least privilege and prompt removal of leavers at both registrar and DNS host.
- Change management: DNS changes follow the same request, approval and testing path as other production changes, with logs retained.
- Record hygiene: periodic reconciliation of records against the asset register, removing dangling CNAME and A entries.
- Resilience: at least two authoritative servers, ideally with independent providers, and a tested recovery plan.
- Integrity: DNSSEC signing where the registry and provider support it, and email authentication records reviewed alongside MX records.
These tests sit within IT general controls: access, change and operations.
Can JCSS Indonesia help review your IT controls?
If DNS, domain ownership or wider IT general controls have never been independently tested, a short scoped review usually surfaces the gaps quickly. Our internal audit, ITGC and cybersecurity service covers access, change management and infrastructure controls. Related reading: what is VAPT testing and our security strategy and governance checklist.
Frequently asked questions
What is DNS in simple terms?
DNS is the internet's directory. It converts a domain name that people can remember, such as a company website address, into the numeric IP address that computers use to find each other. Without it, you would need to type numbers to reach every site, and email could not be routed to the right mail servers.
What is the difference between a recursive resolver and an authoritative name server?
A recursive resolver answers questions on behalf of users by querying other servers and caching the results. An authoritative name server holds the actual records for a domain and gives the definitive answer. Your internet provider or network typically runs the first; your DNS host or registrar runs the second.
Does DNSSEC encrypt my DNS traffic?
No. DNSSEC provides origin authentication and integrity protection, so a resolver can detect forged or altered answers, but RFC 4033 states it does not provide confidentiality. To hide queries from observers on the network you need an encrypted transport such as DNS over TLS or DNS over HTTPS, and the two approaches can be used together.
Why does a DNS change take time to appear everywhere?
Resolvers cache answers for the time to live (TTL) set on each record. Until that period expires, a resolver may keep returning the old value. Lowering the TTL before a planned migration, then restoring it afterwards, is the usual way to make a cutover faster and easier to roll back.
Is DNS part of an IT general controls audit?
It can be. DNS and domain registration underpin websites, email and remote access, so auditors commonly include them under access management, change management and IT operations. The depth depends on the engagement scope and the company's reliance on internet-facing services. Agree this scope in the engagement terms rather than assuming it is covered.
General information only, not legal or tax advice for your specific facts. Regulations change; confirm the current position with JCSS Indonesia before acting.