DNS translates domain names into IP addresses, enabling access to websites, applications, cloud services and email systems.
A misconfigured DNS can make your services unreachable, even if your servers continue to operate normally.
DNS records (A, CNAME, MX, TXT, NS, SRV) play a key role in the availability of websites, emails and IP telephony.
DNS is a strategic component for businesses, as it contributes to service continuity, the performance of cloud infrastructures and the security of communications.
Mechanisms such as DNSSEC, DoH or DoT, combined with continuous monitoring, help strengthen protection against cyberattacks and DNS traffic manipulation.
DNS (Domain Name System) translates human-readable domain names, such as Sewan.be, into IP addresses that machines can process. Without it, every visit to a website, every email sent or every IP-based call would require memorising a string of numbers. This mechanism is so fundamental that a DNS outage or misconfiguration renders all of a company's services unreachable, even if the servers themselves are working perfectly. Without it, users would no longer be able to access a website, send emails or use certain cloud services. For businesses, DNS is therefore a critical component of the network infrastructure, whose availability directly determines business continuity.
What is DNS?
DNS relies on a hierarchical database distributed across thousands of servers around the world. This distributed architecture guarantees two fundamental properties: resilience (no single point of failure) and scalability (billions of requests handled daily without centralised congestion). The availability of a company's services therefore depends directly on the proper configuration and monitoring of its DNS zones. This architecture enables DNS to resolve billions of requests every day while ensuring a high level of availability.
How does DNS resolution work?
Each time a user enters a web address in their browser, a series of invisible exchanges takes place within a few milliseconds in order to retrieve the IP address of the relevant server.
The recursive resolver (usually provided by the operator or configured internally) receives the request. It first checks its local cache. If the answer is there and the TTL (Time To Live) has not expired, it returns it immediately.
The root servers are queried if the cache is empty. They do not know the final address, but indicate which server is responsible for the relevant top-level domain (TLD): .be, .com, .eu, etc.
The TLD server then designates the authoritative server responsible for the requested domain.
The authoritative server finally returns the corresponding DNS record: the IP address, the mail configuration or any other parameter defined in the zone.
The response travels back to the browser, which then establishes the connection with the target server.
The total time ranges from a few milliseconds if the resolver has a cached response, to several hundred milliseconds for a complete resolution from the root servers. This is why a DNS misconfiguration can quickly impact application performance or service availability.
The main types of DNS records
Not all DNS records serve the same purpose. Some provide access to a website, others route emails or secure communications.
The correct configuration of these records, in particular SPF, DKIM and DMARC, directly determines email deliverability and resistance to email spoofing. An error in one of these records can prevent access to a website, disrupt email reception or compromise the security of communications.
Why is DNS strategic for businesses?
Far more than a simple directory of Internet addresses, DNS plays an essential role in the smooth operation of the information system. A reliable configuration contributes to service availability, the security of communications and the performance of the applications used on a daily basis.
Ensuring the availability of digital services
A correctly configured DNS allows users to access websites, business applications, cloud services or email systems at all times. An error or unavailability can quickly render these services unreachable, even if the servers continue to operate.
Securing communications and limiting the risk of cyberattacks
DNS is a prime target for cybercriminals. Mechanisms such as DNSSEC, combined with continuous monitoring of requests, help reduce the risks of malicious redirection, phishing or data exfiltration.
Supporting Cloud, Telecoms and VoIP infrastructures
Cloud services, IP telephony, unified communications and hybrid architectures all rely on DNS to function properly. Fast and reliable resolution directly contributes to the quality of communications, the smoothness of applications and service continuity.
Secure your network infrastructure Take advantage of a Cloud, network and cybersecurity infrastructure designed to guarantee the availability of your critical services.
In most organisations, two DNS environments coexist: a public DNS, accessible from the Internet, and an internal DNS, reserved for the company's resources.
The external DNS manages public resolution and responds to requests from Internet users and partners seeking to reach services exposed on the Internet.
The internal DNS resolves names specific to the private network: file servers, business applications, Active Directory directories, network printers.
This separation is structuring for IT teams. A misconfiguration of the internal DNS can block workstation authentication, render applications unreachable or disrupt automated backups. On a Cloud infrastructure, the management of private DNS zones requires particular attention during migrations or perimeter extensions.
DNS and IP telephony
VoIP telephony relies on SRV records to locate SIP servers and establish call sessions. Excessive DNS resolution times translate directly into delays in setting up communications, or even connection failures — an impact rarely anticipated during the deployment of a voice infrastructure.
For hosted telephony, where the PBX is outsourced to the operator, the reliability of DNS determines the permanent reachability of the company. The same applies to CTI integrations (computer-telephony integration), which rely on accurate resolutions to synchronise business applications with call flows. The quality of Internet access links and the management of traffic flows via SD-WAN affect these resolution times and, by extension, the smoothness of voice and cloud services.
DNS security: threats and protections
Main threats: spoofing, cache poisoning and tunnelling
DNS is a prime target for attackers because it is omnipresent and often poorly monitored.
DNS spoofing (or cache poisoning) consists of injecting false responses into a resolver's cache. Users are then redirected to malicious servers, phishing pages or credential collection, without any visual sign of an anomaly.
DNS tunnelling, more sophisticated, exploits the protocol to transit exfiltrated data or control commands through firewalls that filter other protocols. It is a vector frequently used in advanced persistent threats (APT).
Protecting yourself: DNSSEC, DoH and DoT
DNSSEC (DNS Security Extensions) adds a cryptographic signature to DNS records, allowing a compatible resolver to verify that a response indeed comes from the legitimate authoritative server and has not been altered in transit. This mechanism neutralises most cache poisoning attacks.
DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the exchanges between the client and the resolver, preventing their interception or manipulation along the network path. These protocols are particularly relevant for mobile employees or remote access.
Real-time traffic monitoring complements these protocol-level mechanisms by enabling the detection of abnormal behaviour: spikes in requests to unknown domains, patterns characteristic of tunnelling, attempts to resolve algorithmically generated domains (DGA). This is the scope covered by a managed SOC, which integrates DNS flow analysis into its overall IS monitoring. Managed services allow companies to delegate this monitoring without setting up a dedicated internal team — an option suited to SMEs whose cybersecurity must fit within a controlled operational budget.
This monitoring can be provided by a managed SOC capable of analysing DNS flows continuously. By relying on managed cybersecurity services, companies strengthen their protection while limiting the operational burden on their IT teams. At Sewan, this approach is part of an overall strategy for securing network and Cloud infrastructures.
FAQ: DNS
A DNS resolver is the component that receives the user's request and carries out the search by successively querying the servers in the hierarchy. An authoritative DNS server is the one that holds the definitive answer for a given domain.
The TTL (Time To Live) is the period during which a DNS response can be kept in cache before being refreshed. A short TTL speeds up the propagation of zone changes but increases the number of requests to the authoritative servers; a long TTL reduces the network load but delays the application of changes. In practice, the TTL is lowered 24 to 48 hours before any migration operation to limit its impact.
Public DNS resolvers offer high performance and global availability, but requests transit outside the company's perimeter. The operator's DNS or an internal resolver allows you to retain control of traffic, apply filtering policies and log resolutions, which is often required in a compliance or security audit context. For most companies, an internal resolver coupled with an operator resolver as a fallback represents the most robust balance.
DNSSEC is not imposed by general regulations for Belgian companies. It is nonetheless recommended as a security best practice in order to protect DNS services against DNS response forgery attacks. For organisations subject to the NIS2 directive, DNSSEC is not explicitly mandatory, but it can constitute a relevant technical measure within the framework of cybersecurity risk management. For .be domains, activating DNSSEC is optional: it is a recommended but not mandatory security mechanism. DNS Belgium supports DNSSEC, whose activation remains at the initiative of the domain holder or its DNS provider.
Ensure the continuity of your services Centralise your Cloud, Network and Telecoms services with solutions designed to guarantee performance, security and business continuity.
