What is DNS?
DNS (Domain Name System) is the internet's address book: it translates domain names that humans can remember into the IP addresses computers communicate with. When someone types misupportit.dk into the browser, their computer asks a chain of DNS servers until the answer comes back, typically within a few milliseconds. The system is hierarchical and distributed: from the root servers at the top, through the .dk zone (operated by the Danish registry Punktum dk), down to your own zone with your records.
Without DNS, the internet stands still. And more importantly for you: without correct DNS, your business stands still: website, email and integrations all depend on the records in your zone.
The most important DNS records
A handful of record types cover most everyday needs:
- A / AAAA: Points a name to an IPv4/IPv6 address: what makes the website respond.
- CNAME: An alias pointing to another name, used for www, cloud services and verifications.
- MX: Determines which servers receive your email. A wrong MX record = no incoming mail.
- TXT: Free-text records that in practice carry security and verification: the SPF sender list, the DMARC policy, DKIM keys and domain verifications for Microsoft 365, Google and others.
- NS: Designates which name servers are authoritative for the zone: effectively who controls everything above.
Each record has a TTL (time to live) that governs how long answers are cached. A low TTL gives fast changes; a high TTL gives robustness and fewer lookups.
DNS as an attack surface
Whoever controls your DNS controls your digital identity. If an attacker takes over access to your DNS administration (typically via phishing of the registrar login), email can be redirected, visitors can be sent to fake sites, and valid TLS certificates can be issued for your domain. On top of that come attacks on the lookups themselves, where forged DNS answers (cache poisoning) send users to the attacker's server without touching your systems.
The defence is concrete: MFA and strict access control on registrar and DNS accounts, a registry lock on the domain, a clean-up of old records, and DNSSEC, which signs your zone cryptographically so forged answers can be exposed.
DNS in practice: where things go wrong
The classic own goals are mundane: the domain is registered to a former employee's private email; nobody knows where the DNS is administered; an old TXT or CNAME record points to a decommissioned service that an attacker can take over (subdomain takeover); or an email migration fails because nobody dared touch the MX records. DNS is infrastructure: it must be documented, owned by the company and reviewed regularly like everything else in the IT infrastructure.
How MI Support IT helps
We administer DNS for our customers as a standard part of operations: documented zones, secured registrar accounts, correctly configured mail records (SPF/DKIM/DMARC) and DNSSEC where it makes sense, together with the rest of your IT security. Contact us if you are not entirely sure who actually holds the keys to your domain today.