Table of Contents
If you work with DNS regularly, you already know how fast things move. Threat actors keep finding new ways to abuse the protocol, resolver implementations keep shipping CVEs, and the gap between a well-configured zone and a vulnerable one is often just a few missing records.
There is no shortage of general security blogs out there, but DNS coverage tends to get diluted in the noise. Things like subdomain takeover risks, TXT record malware indicators, dangling nameservers, or a zone transfer left open by accident rarely make general security headlines, but they are the kind of issues that change the real security posture of a domain.
That's why we collected a list of blogs that are deliberately DNS-specific. No general security news sites, no vendor marketing dressed up as content. Let’s begin!
Introduction
1. SANS Internet Storm Center
Link: isc.sans.edu
The ISC diary is written by a rotating group of security practitioners, and DNS-related entries show up constantly. On any given week you will find analysis of DNS-based C2 traffic, newly observed tunneling patterns, or a breakdown of how a specific malware family is using DNS to phone home.
The format is direct: here is the traffic, here is what it means, here is what to watch for. There is not a lot of editorializing, which is useful when you need signal over noise. For practitioners actively investigating DNS anomalies, it is one of the more reliable places to cross-reference.
2. Cloudflare Blog
Link: blog.cloudflare.com
Cloudflare operates one of the largest authoritative and resolver DNS networks on the planet, which means their security posts are backed by real query volume at scale. Their DNS content covers DDoS amplification breakdowns, response rate limiting, anycast behavior under attack conditions, and the operational realities of deploying encrypted DNS across millions of clients.
When they write about something like DNS rebinding or amplification vectors, it reflects what they are actually seeing in production. Their writing on DNS over HTTPS and DNS over TLS has been some of the more grounded coverage of the encrypted DNS transition, without the hype that tends to surround those topics.
3. DNSAudit Blog
Link: dnsaudit.io/blog
Our own DNSAudit blog covers DNS security from a practical, zone-level perspective. The posts tend to focus on things that are easy to miss in day-to-day operations: how TXT record sprawl creates unintended exposure, what DNS misconfigurations look like after a migration goes wrong, why SPF, DKIM, and DMARC alone do not close all the doors on email spoofing.
The research is grounded in real-world scan data. A post on TXT record exposure across Fortune 500 domains documented what kind of sensitive data leaks through public DNS without anyone noticing. The forgotten subdomains study traced how ghost DNS records accumulate over time and what risk they actually introduce. A more recent piece on why SPF, DKIM, and DMARC are not enough takes a closer look at the gaps people still miss.
If you manage zone transitions or work in environments where migrations are common, the top DNS misconfigurations post and the DNS mistakes after migration piece are both worth reading.
4. Infoblox Threat Intelligence Blog
Link: blogs.infoblox.com
Infoblox is a DDI vendor, but the threat research coming out of their team is genuinely useful independent of the product angle. Their researchers have published detailed work on DNS-based malware delivery, malicious TXT record usage, lookalike domain campaigns, and the DNS infrastructure patterns that link cybercrime operations together.
The research from Renee Burton's team tends to be ahead of the news cycle. If a threat actor group adopts a new DNS-based technique, there is a reasonable chance Infoblox has already started mapping it before it becomes widely documented elsewhere. Their parked domain and DDNS abuse research has been referenced across the wider threat intelligence community, and if you want to see how those patterns translate into actual zone indicators, the DNSAudit TXT malware scanner is a useful companion.
5. Cisco Talos Intelligence Blog
Link: blog.talosintelligence.com
Talos publishes some of the most technically thorough DNS threat analysis available. Their coverage of DNS-based command and control, malware families that abuse DNS for data exfiltration, and threat actor infrastructure mapping is consistently detailed and well-sourced.
They track how specific malware families use DNS as a covert channel, document tunneling techniques, and regularly publish IOC lists that include domain patterns and DNS query signatures. One theme that comes up regularly in their research is how much leaks from DNS records that were never intended to be public-facing.
Issues like service discovery exposure and exposed sensitive subdomains are exactly the kind of thing Talos researchers find when mapping threat actor infrastructure, and they are also the kind of thing that tends to go unnoticed in production zones until someone looks for them deliberately.
6. RIPE NCC Labs
Link: labs.ripe.net
RIPE NCC Labs publishes measurement-driven research on Internet infrastructure, and DNS is a core part of that. Their work on DNSSEC deployment trends, resolver behavior across different regions, DNS root server traffic, and the overall health of the DNS ecosystem is backed by data from the RIPE Atlas measurement platform.
If you want to understand how DNS actually behaves at scale across resolver implementations and geographic regions, this is one of the better sources. Their DNSSEC adoption tracking is particularly useful if you are making an internal case for signing your zones, since it shows the gap between what is technically possible and what is actually deployed.
7. APNIC Blog
Link: blog.apnic.net
The APNIC Blog covers DNS from an Internet operations angle, and the quality of the DNS-specific content is consistently high. Posts cover resolver behavior, caching edge cases, DNSSEC operational failures, DNS privacy, and abuse patterns observed across the Asia-Pacific region.
The writing is accessible without being shallow. Guest posts from operators and researchers sit alongside the APNIC staff, which keeps the perspectives varied. Their coverage of the DNS privacy debate, particularly around resolver choice and DoH/DoT deployment decisions, has been some of the more nuanced treatment of that topic in an industry that tends toward strong opinions on both sides.
8. ISC (Internet Systems Consortium)
Link: www.isc.org/blogs/
ISC develops BIND and Kea, which makes their blog the primary source for anything related to resolver and authoritative server security. CVE disclosures for BIND vulnerabilities, guidance on securing resolver configurations, and documentation on DNS protocol feature implementations all come through here first.
If you run BIND in any form, the ISC blog is not optional reading. Their posts on open recursion, DNSSEC validation, and response policy zones are written for operators rather than researchers, which makes them immediately actionable.
9. Nominet Research
Link: nominet.uk/blog/
Nominet is the registry operator for .uk domains and has one of the longer track records of DNS abuse research among ccTLD operators. Their security team publishes analysis on DNS abuse at the registry level, including malicious domain registration patterns, DNS hijacking campaigns, and the infrastructure signatures that connect domain abuse to broader cybercrime networks.
Because they operate at the registry level, their perspective is different from what you get from a resolver operator or a zone administrator. They see patterns across the entire .uk namespace, which surfaces things that individual domain operators would never detect on their own. Their work on domain generation algorithms and DNS-based botnet infrastructure gets cited fairly regularly in wider threat research.
10. Verisign Blog
Link: blog.verisign.com
Verisign operates the .com and .net TLDs, which puts them at the top of the DNS hierarchy for a significant portion of the Internet. Their blog covers DNSSEC from an authoritative registry perspective, domain security research, and the infrastructure behind TLD operations.
Their DNSSEC posts reflect what is actually happening at the registry level, which is a different vantage point than you get from resolver operators or zone administrators. If you care about how DNSSEC trust anchors propagate or how delegation security works at the TLD level, this is the right source for that. Their writing on DNS amplification and abuse mitigation at scale is also worth reading for anyone responsible for high-traffic zones.
A Note on Auditing Your Own Domains
Reading about DNS security and actually auditing your infrastructure are different things. A lot of the issues covered in the blogs above tend to sit undetected for a long time because nobody looks for them systematically.
DNSAudit.io runs a full audit against any domain you submit, covering everything from DNSSEC configuration gaps to nameserver redundancy to shared IP reputation risks. The results tend to surface things that are easy to miss, and the DNS security docs section is a solid reference if you want to go deeper on any of the findings.
