NIST Updates DNS Security Guidance With SP 800-81r3

Summary

NIST SP 800-81r3 replaces its 2013 DNS guidance, recommending protective DNS, encrypted DNS where feasible for U.S. federal civilian agencies, updated DNSSEC practices, and stronger operational resilience.

Key points

• NIST SP 800-81r3 replaces the previous DNS security guidance from 2013.
• The guidance treats DNS as a proactive security control and recommends integrating DNS logs with SIEM data and DHCP lease information.
• NIST recommends hybrid cloud and on-premises protective DNS deployments for security and resilience.
• It calls for encrypted DNS protocols—DoT, DoH, and DoQ—for U.S. federal civilian agencies wherever technically feasible, with controls to prevent bypassing internal DNS.
• DNSSEC recommendations include ECDSA and Edwards-curve algorithms, shorter signature validity periods, and hardware security modules to protect private keys.
• Operational recommendations include separating authoritative and recursive DNS functions, monitoring dangling CNAMEs and typosquatting, and using geographically distributed authoritative servers.

Countries