NIST Special Publication (SP) 800-81 Revision 3, Secure Domain Name System (DNS) Deployment Guide, became the final NIST guidance on March 19, 2026, and is now a first-class security control, according to the National Institute of Standards and Technology (NIST). While NIST’s DNS deployment guide has been a mainstay of the DNS community for nearly two decades, this latest update comes after 10 years of enormous change in how networks are built, used and attacked.

Clearly, there’s been a lot of ground left uncovered since the last update to NIST’s guidance on DNS deployment: Protective DNS, encrypted DNS, new cyber threats and regulations, not to mention the broad adoption and rapid evolution of AI technology. The newly published NIST SP 800-81r3 comes at a critical time and makes a key argument: formally elevating DNS from a background utility to an essential pillar of cyber resilience. That shift has major implications for boards, regulators, security teams and critical infrastructure leaders. NIST now explicitly recognizes DNS as an active security control, rather than just networking infrastructure.

The update makes things crystal clear: DNS is simultaneously one of the biggest cyber risks and one of the most powerful controls for security teams.

Why This Update Matters Now

Importantly, this new guidance is a broader, three-pillar blueprint: secure the DNS infrastructure, ensure the integrity of DNS systems and configurations, and implement Protective DNS as a cybersecurity control.

It also cements what the industry has increasingly come to know: DNS can no longer be treated as background “plumbing” delegated entirely to operations.

DNS has quietly become national‑security‑grade infrastructure: governments are legislating for “cyber resiliency,” but traditional guidance often glosses over DNS; this update closes that gap by spelling out DNS’s role in resilience, incident response and zero trust architectures.

From Hidden Vulnerability to Strategic Control Point

Threat intelligence shows it: cybercriminals love DNS. It’s always available and often ignored by security teams. Threat actors like Hazy Hawk and Horrid Hawk hijack poorly configured DNS domains for malware campaigns, while groups like Loopy Lizard register lookalike domains to power phishing and fraud.

These cases illustrate a clear pattern of DNS abuse. They’re not one-off technical issues, but infrastructure-level weaknesses that can undermine every other security investment in your tech stack. In response to these rising threats, SP 800-81 sheds an important light on the risk posed by DNS misconfiguration.

According to NIST, new approaches to DNS are the solution. While Protective DNS has been a part of NIST’s guidelines since 2010, this update elevates it as a core control and highlights DNS telemetry – query and response logs – as essential evidence for incident investigation and exposure analysis.

If security and tech teams shift to this type of preemptive approach, they’ll find that DNS is a uniquely universal, high-fidelity control point that can stop threats faster.

Closing the DNS Confidentiality Gap

DNS requests have long been an open window into an organization’s activity. While most web traffic is encrypted, up until recently, DNS requests were typically sent in clear text. This opened organizations to potential data leakage and surveillance, posing a threat to their overall cybersecurity.

Encrypted DNS is a new addition to NIST’s guidance on DNS, though this approach has been adopted globally by governments since the last update to SP 800-81. Its inclusion in the recently published update makes clear that confidentiality is no longer just a nice-to-have.

SP 800-81: An IT Leader’s Checklist

So, what does this update mean for you? If you haven’t yet, it’s time to ensure that your DNS strategy is in line with the best modern practices:

Benchmark your DNS posture against SP 800-81r3: Assess infrastructure, configuration hygiene and Protective DNS coverage against the new blueprint and take steps to address any gaps.

Elevate DNS in resilience and regulatory planning: Make DNS architecture and logging part of core resilience programs and board-level risk discussions, particularly where regimes like NIS2 reference NIST guidance.

Invest in expertise and operationalization: Pair technology changes (Protective DNS, encrypted DNS) with training, workshops and external expertise to embed DNS security into day-to-day operations and incident response.

If you’re still treating DNS as background infrastructure, you’re missing one of your most powerful levers for defending the business. The new NIST guidance makes that impossible to ignore.