middle.network
Health check
Guide for auditors

DNS and domain controls auditors overlook: DNSSEC, registrar lock and nameserver redundancy

The domain itself is an asset. How to check it is owned, protected and resilient.

Auditors and IT managers6 min readUpdated

The single point of failure nobody registers

Website, email, single sign-on and most SaaS integrations depend on one domain name. If it expires, is transferred away or has its DNS changed by an attacker, all of them fail at once. Yet the domain rarely appears on the asset register or the supplier list.

Ownership and the registrar

  • Expiry: the registration should run well ahead, with auto-renew on and a payment method that won’t lapse.
  • Transfer lock: clientTransferProhibited should be set, so the domain can’t be moved to another registrar without an extra step.
  • Registrar account: who holds the login, and is it protected with multi-factor authentication? Ask; it can’t be seen from outside.
  • Registrant: is the domain held by the organisation, or by a former employee or agency?

DNS integrity: DNSSEC and CAA

DNSSEC signs DNS answers so resolvers can detect forged ones. Check that the chain of trust is complete from the top-level domain down; a broken chain is worse than none, because validating resolvers will refuse the domain.

CAA records name the certificate authorities allowed to issue certificates for the domain.

Resilience

  • At least two nameservers, ideally on different networks or providers.
  • Every nameserver answers with the same serial: a mismatch means updates aren’t reaching all of them.
  • Changes reach resolvers worldwide: a propagation check from several regions confirms it.
Tip: Ask when DNS last changed and who approved it. DNS changes bypass change management surprisingly often, and they are a common cause of outages.

Mapping

ISO 27001:2022: A.5.9 inventory (the domain is an asset), A.5.19 supplier relationships (registrar and DNS host), A.8.14 redundancy (nameservers), A.8.24 cryptography (DNSSEC). NIST CSF 2.0: ID.AM-02 and PR.IR-03.

This maps what we can see from the internet to common controls, to help you gather evidence. It isn’t a certification, an audit opinion or legal advice. Your auditor, your scope and your Statement of Applicability decide what applies.

More guides

ISO 27001:2022 evidence you can collect from outside the network Which Annex A controls leave a trace on the internet, and how to evidence them in ten minutes. 8 min read · ISO 27001 auditors and ISMS owners
Auditing email authentication: SPF, DKIM and DMARC explained for auditors What each record proves, the five findings that matter, and the questions to ask. 7 min read · Auditors, GRC teams, IT managers
TLS and certificate evidence for ISO 27001 A.8.24 and SOC 2 CC6.7 Protocol versions, certificate management and HSTS: what to check and what to ask for. 6 min read · Auditors and security engineers
The ten-minute external security review: a checklist for auditors A repeatable outside-in review of any organisation’s domain, with what to record. 6 min read · Auditors and third-party risk teams