In brief: NIST has revised SP 800-81r3 after 12 years and positions DNS security as a mandatory component for critical infrastructure.
The National Institute of Standards and Technology has fundamentally updated its DNS security guidance Special Publication 800-81r3 for the first time in twelve years. The update establishes DNS as a core element of resilient infrastructure and sharpens requirements for DNS protection.
The revised NIST SP 800-81r3 sets new standards for DNS security. The last version dated from 2012, since then the threat landscape has deteriorated significantly – DNS-based attacks have become a preferred attack vector for cybercriminals and state-sponsored actors.
For CISOs, the update represents an explicit obligation not to treat DNS security as a downstream configuration task, but rather as a strategic protective layer. The guidance addresses organizations that have not yet established a structured DNS security focus – these must now develop a strategy that meets regulatory requirements.
A central element of the new guidance is Protective DNS as an active defense measure. This encompasses not only DNS validation (DNSSEC) but also proactive detection and blocking of malicious DNS queries at the gateway level. Protective DNS acts as a control layer against malware C2 communication, phishing domains, and data exfiltration over DNS tunnels.
The updated publication also accounts for the NIS2 Directive: in the EU context, DNS security is increasingly being codified as a governance requirement for operators of critical infrastructure and digital services. Organizations should use SP 800-81r3 as a reference to assess their DNS architecture, monitoring capacity, and incident response processes.
Source: www.security-insider.de · Published 27 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.