INF-016 Domain, DNS and Routing Security
Description
An inventory of the public domains, DNS zones and registrar accounts used by the service records an owner and a renewal date for each. Registrar accounts are locked against unauthorised transfer and protected by multi-factor authentication. Authoritative name resolution is fault-tolerant across independent nodes or providers and is separated from recursive resolution. Its zones and their delegations to child zones are signed so that responses carry origin authentication and integrity verification; resolvers used by production systems validate those signatures. DNS records are checked at defined intervals for entries that resolve to decommissioned or unclaimed resources, with any found removed or reclaimed. The inventory also records, for each address range and routing origin the service is announced from or depends on, the routing security measure in force over it and who applies that measure, which is the infrastructure operator where the organisation announces no address space of its own. Where the organisation announces its own space, the origin is registered in the relevant internet routing registry and carries a route origin authorisation, and an announcement that fails origin validation is rejected on the paths production traffic depends on.
Rationale
A domain name is the root of trust for transport encryption, single sign-on and session cookies, so an expired registration, an unlocked registrar account or a record left pointing at a released cloud resource hands an attacker a trusted name and everything that depends on it. Three low-baseline NIST controls covering it were unmapped before S4. DAT-004 holds transmission encryption and the certificates issued against these names; INF-005 holds network architecture and egress filtering. Signing and validation are usually a setting at the DNS provider rather than a build, so the working part of this control is the inventory, the renewal owner and the dangling-record check. Routing hygiene reaches most providers through somebody else: the address space is the cloud operator's and so is the filtering, which makes the honest test a recorded statement of whose measure applies rather than a configuration the organisation could produce. Where the organisation does announce its own space, origin registration and validation are the measures with an artefact behind them and the rest of routing best practice follows from them.
Applicability (9 profiles)
Annex point 6.7.2(l) is now stated in both halves. The inventory records, for each address range and routing origin the service is announced from or depends on, the routing security measure in force and who applies it, with origin registration and authorisation where the organisation announces its own space and the operator's published statement where it announces none. The control is renamed Domain, DNS and Routing Security.
Framework Mappings (4)
| NIS2-CIR-6.7 | Network Security | partial |
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | full |
| SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | full |
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service | full |
Evidence (3)
Export of the domain and DNS zone inventory from the registrar and DNS provider, showing the owner, renewal date, transfer lock state and multi-factor authentication state of each account.
Example: Registrar portfolio export and DNS provider zone list, 2026-09-01, covering every registered domain with its expiry date, lock status and the account owner.
Test: Export the domain portfolio from each registrar and the zone list from each DNS provider. Verify: (1) every public domain and zone used by the service appears in the inventory with a named owner, (2) no domain is past its renewal date or within the renewal window without a renewal record, (3) transfer lock is set on every domain the registrar supports it for, (4) every registrar and DNS provider account requires multi-factor authentication, (5) the inventory has no zone that the service no longer uses. (6) the record names each address range and routing origin the service is announced from or depends on, the routing security measure in force over it and who applies it, (7) where the organisation announces its own space, the origin appears in the relevant internet routing registry with a route origin authorisation, and where it announces none, the operator's published statement of its routing measures is held and dated.
DNS configuration showing zone signing and the delegation records that chain each signed child zone to its parent, the authoritative name server set and the validation setting on the resolvers production systems use.
Example: Zone signing status and delegation signer records for the primary zone, with the resolver configuration applied to production compute, exported 2026-09-01.
Test: Read the DNS configuration from the provider or its infrastructure code. Verify: (1) each authoritative zone is signed and its delegation record is published at the parent, (2) authoritative name servers are spread across independent nodes or providers so the loss of one does not end resolution, (3) the authoritative service does not also serve recursive queries for arbitrary clients, (4) resolvers used by production systems validate signatures and reject a response that fails validation.
Output of the check for DNS records that resolve to decommissioned or unclaimed resources, with the disposition of each finding.
Example: Dangling record scan across all zones, 2026-08-28, listing every alias and address record whose target no longer resolves to a resource the organisation holds.
Test: Obtain the most recent dangling-record check and its schedule. Verify: (1) the check covers every zone in the inventory, (2) it ran within the defined interval, (3) each record whose target is no longer held by the organisation was removed or reclaimed, with a date, (4) records created since the last run are within scope of the next one.
Questions (3)
Is there an inventory of every public domain and DNS zone used by the service with a named owner for each?
Marketing sites, regional domains and defensive registrations count. A domain nobody owns is the one that expires.
Which of the following protect your domains and name resolution?
Signing and validation are separate settings and one without the other protects nothing. The check for records pointing at released cloud resources is what closes subdomain takeover. The routing item is answerable by a provider that owns no address space: what is recorded there is whose measure applies and the statement it comes from.
How often are DNS records checked for targets the organisation no longer holds?
Options run from strongest to weakest. The exposure window is the gap between releasing a cloud resource and removing the record that points at it, so the interval is the control.