Edge DNS & DNS Security

The DNS risk surface

Edge DNS — authoritative resolution

Edge DNS is a fully managed authoritative DNS service running on Akamai's globally distributed anycast network. Its defining property for security is architectural: attack traffic aimed at your zone lands on hundreds of points of presence simultaneously, so no single site absorbs the full load. A flood that would obliterate a pair of self-hosted nameservers is diluted across the platform.

Core capabilities

• Anycast, multiply-redundant delivery across independent name server sets, engineered so that failure or attack on one set does not remove resolution.
• Primary or secondary operation — run Edge DNS as your primary zone host, or as a secondary receiving AXFR/IXFR from your hidden primary. Secondary mode is the low-risk on-ramp: you keep your existing provisioning workflow and gain a resilient serving tier.
• Zone apex support — alias/ANAME-style records that let example.com (not just www) point at a CDN hostname, which plain CNAME cannot do at the apex.
• DNSSEC signing — automated online signing and key rollover, removing the operational fragility that causes most DNSSEC outages.
• API and IaC control — zones and records managed programmatically, so records live in version control and changes are reviewable.
• Query analytics — per-zone, per-record-type query telemetry, the basis for spotting NXDOMAIN storms early.

DNSSEC operational notes

DNSSEC gives resolvers cryptographic proof that an answer came from the zone owner and was not modified. The failure modes are almost always operational rather than cryptographic:

• Expired signatures — RRSIGs have validity windows; if resigning stops, the zone goes dark for validating resolvers. Managed signing removes this class of incident.
• DS/KSK mismatch — the DS record at the parent must match the current KSK. Rollovers must be sequenced, with TTLs respected at each stage.
• NSEC vs NSEC3 — NSEC proves non-existence but permits zone walking; NSEC3 hashes the names to make enumeration expensive. Use NSEC3 for zones whose record names are themselves sensitive.
• DNSSEC is not encryption — queries and answers remain visible. Use DoT/DoH for confidentiality.

Resilience patterns

• Multi-provider authoritative DNS — delegate to two independent providers with synchronised zones. This survives a total provider outage, at the cost of more complex change management and DNSSEC coordination.
• TTL strategy — 300s for records fronting production endpoints (fast failover), longer for stable infrastructure. Do not lower every TTL to 30s “just in case”; you multiply query volume and therefore your DDoS exposure.
• Registry lock at the registrar, plus MFA and alerting on NS/DS changes. A hijacked delegation defeats every other control you own.

DNS Shield

DNS Shield places a dedicated caching and filtering tier between recursive resolvers and authoritative infrastructure. The value is twofold: it absorbs abusive query patterns (particularly random-subdomain floods that are uncacheable by design) before they reach authoritative servers, and it shortens the resolution path from major ISP resolver networks, improving both latency and reliability for real users.

Global Traffic Management

GTM is DNS-based load balancing and failover: liveness and performance checks decide which answer a resolver receives. Security relevance:

• Automatic failover away from a datacentre that is under attack or degraded, without a human in the loop.
• Geographic and weighted steering to shed load or route a region to scrubbing during an incident.
• Health-check driven withdrawal of an origin that is failing, preventing a partial outage from becoming a total one.

Remember the constraint: DNS-based steering is only as fast as the TTL and as accurate as the resolvers' behaviour — some resolvers and clients ignore TTLs. Plan for a tail of traffic that continues to hit the old answer.

Protective / recursive DNS — the outbound direction

Everything above protects inbound resolution of your names. Protective DNS addresses the opposite direction: what your users, servers and IoT devices resolve on their way out. Because virtually all malware performs DNS lookups — for command-and-control, for payload staging, or to tunnel stolen data — the recursive resolver is a uniquely efficient enforcement point.

What it blocks

• Command-and-control domains — resolution is refused or sinkholed, cutting the malware off before any TCP session exists.
• Phishing domains — including newly registered and typosquatted lookalikes, which are heavily weighted by risk scoring.
• DNS tunnelling / exfiltration — detected by entropy, label length, query rate and record-type anomalies (excessive TXT/NULL queries to a single domain).
• DGA (domain generation algorithm) traffic — high-volume NXDOMAIN patterns with algorithmically random labels.
• Acceptable-use categories — policy enforcement per user group or location.

Deployment considerations

• Point your forwarders and DHCP-advertised resolvers at the protective service, and block outbound port 53 to everything else — otherwise malware simply uses its own resolver. Also consider blocking or controlling known DoH endpoints, which bypass DNS policy over 443.
• Start in monitor mode to discover legitimate long-tail domains before enforcing.
• Feed resolver logs into the SIEM: DNS telemetry is one of the highest-signal, lowest-volume detection sources available.
• Expect false positives on newly registered domains used by legitimate marketing campaigns; have a fast allow-list path.

DNS security checklist

1. Inventory every zone and every record; hunt dangling CNAMEs monthly.
2. Registry lock plus MFA at the registrar; alert on NS and DS changes.
3. Authoritative DNS on anycast with capacity far beyond your peak; consider multi-provider.
4. DNSSEC signed with managed key rollover; monitor signature expiry externally.
5. Disable open AXFR; restrict transfers to known secondaries.
6. CAA records to constrain which CAs may issue for your domain.
7. Deliberate TTL policy documented per record class.
8. Protective recursive DNS outbound, with port 53 egress locked down.
9. Monitor query volume, NXDOMAIN ratio and response codes; alert on deviation.