
AWS Certified Advanced Networking – Specialty (ANS-C01) Certification Guide
By :

DNS’s design predates the internet, when security was not a top-of-mind concern. This makes DNS relatively vulnerable to attack as it wasn’t designed with the idea of making it resilient in the face of threat actors.
DNS spoofing and cache poisoning are common techniques to facilitate MitM attacks, where the attacker masquerades as the legitimate service the user is trying to reach. Additionally, DNS can be a useful source of target discovery through the enumeration of DNS records. Attackers typically use tools and scripts to automate the process.
Segmentation, such as using split DNS or private hosted zones (PHZs), along with implementing DNSSEC are key strategies for enhancing network security. These approaches help control access to DNS information and protect against potential domain name service attacks. The following list explores each in more depth: