Every time you type a website address into your browser, something happens behind the scenes that most people never think about. Your computer asks a question: "What's the IP address for google.com?" A system called DNS (Domain Name System) answers that question. It's basically the internet's phone book, translating the human-readable names you type into the numerical addresses computers actually use to find each other.
Here's the problem: that phone book? It was designed in the 1980s. It has almost no built-in security. And attackers have been exploiting it for years in ways that are genuinely clever and genuinely dangerous.
Let me walk you through how DNS works, why it matters for your business, and what you can do about it without needing a networking degree.
How DNS actually works (the 30-second version)
When you type "bankofamerica.com" into your browser, your computer doesn't know where that is. It sends a DNS query to a DNS resolver (usually provided by your internet service provider) asking for the IP address. The resolver looks it up, sends back the answer (something like 171.159.228.150), and your browser connects to that IP address.
This happens for every single website, every email you send, every app that connects to the internet. Cisco estimated that over 90% of malware uses DNS at some point during an attack, whether to phone home to a command server, download additional payloads, or exfiltrate stolen data.
The entire process is invisible to you. And that's exactly why it's dangerous, because if someone can tamper with the answers your DNS resolver gives you, they can send you to a fake website without you ever knowing.
The attacks you've never heard of
DNS hijacking
This is the straightforward one. An attacker compromises your DNS settings (either on your router, your computer, or your DNS provider) and redirects your queries to their own server. You type in your bank's URL, your DNS gives you the wrong IP address, and you land on a perfect copy of your bank's login page. You enter your credentials. The attacker has them.
In 2019, CISA issued an emergency directive about a widespread DNS hijacking campaign that redirected government and private sector domains. The attackers modified DNS records to intercept web and email traffic, capturing credentials in real time. This wasn't theoretical. It was happening to actual organizations, including ones with security teams.
DNS cache poisoning
Your DNS resolver caches (stores) answers so it doesn't have to look them up every time. DNS cache poisoning is when an attacker injects a fake answer into that cache. Once the cache is poisoned, everyone using that resolver gets the wrong answer until the cache expires.
The Kaminsky attack, discovered in 2008 by security researcher Dan Kaminsky, showed that DNS cache poisoning was far easier than anyone thought. It led to an emergency, coordinated patch across the entire industry. The vulnerability was in the fundamental design of DNS, not in any specific software.
Malicious domains and command-and-control
When malware infects a computer, it usually needs to "phone home" to receive instructions from the attacker. It does this through DNS, connecting to a domain the attacker controls. The malware might also use DNS to download additional tools or exfiltrate (steal and transmit) your data. All of this happens through normal DNS traffic, which most firewalls don't inspect.
Palo Alto Networks' Unit 42 research found that DNS tunneling (hiding data inside DNS queries to bypass security controls) is used by multiple advanced attack groups. The data moves in and out disguised as ordinary DNS traffic, and unless you're specifically looking for it, you'll never see it.
DNS filtering: the security layer most small businesses are missing
Here's the good news. DNS is also the easiest place to add a security layer, precisely because every internet connection goes through it.
DNS filtering works by checking every DNS query against a list of known-bad domains before your computer connects. If someone clicks a phishing link that points to a malicious domain, the DNS filter blocks the connection before any data is exchanged. The fake bank login page never loads. The malware can't phone home. The data exfiltration fails.
Think of it like a bouncer at the door of the internet. Before you're allowed to connect to any website, the bouncer checks the address against a list. Known malware distribution site? Blocked. Phishing domain registered yesterday? Blocked. Cryptomining pool? Blocked.
Options that actually work for small businesses
[Cloudflare Gateway](https://www.cloudflare.com/zero-trust/products/gateway/) offers a free tier for small teams. You point your network's DNS to Cloudflare's servers, configure your filtering policies, and you're done. Setup takes about 15 minutes on most routers.
[Cisco Umbrella](https://umbrella.cisco.com/) (formerly OpenDNS) is the enterprise option with a small business tier. It's been in the DNS security space longer than anyone and has one of the largest threat intelligence databases.
[NextDNS](https://nextdns.io/) is excellent for small businesses that want granular control. The free tier covers 300,000 queries per month, which is enough for a small office.
All of these work the same basic way: you change your DNS server settings (on your router for office-wide protection, or on individual devices for remote workers), and all DNS queries get filtered through their security layer. No software to install on every machine. No maintenance. No performance impact you'd ever notice.
DNSSEC: the authentication layer
DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS responses, so your computer can verify that the answer it received is legitimate and hasn't been tampered with. It's the fix for cache poisoning and many forms of DNS hijacking.
ICANN (the organization that coordinates the internet's naming system) has been pushing DNSSEC adoption for years. Check if your domain registrar supports it and turn it on. For most registrars, it's a single toggle in your domain settings.
What to do right now
Here's the actionable part:
Step 1: Change your office router's DNS settings to a filtering provider (Cloudflare Gateway, NextDNS, or Cisco Umbrella). This takes 15 minutes and immediately protects every device on your network.
Step 2: For remote workers and laptops that leave the office, install the provider's agent or configure DNS-over-HTTPS in the browser. This ensures protection travels with the device.
Step 3: Enable DNSSEC on your own domain through your registrar. This protects your customers and partners from being redirected when they try to visit your site.
Step 4: If you have an IT provider managing your small business cybersecurity, ask them what DNS filtering you currently have in place. If the answer is "none" or "whatever our ISP provides," that's a conversation worth having today.
DNS is the invisible infrastructure that everything else depends on. Securing it is one of the highest-impact, lowest-effort things you can do. The phone book doesn't have to be dangerous. You just have to stop using the unprotected version.
