- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
Every cyberattack begins with a DNS lookup. Whether an attacker is delivering malware, establishing a command-and-control (C2) channel, or quietly exfiltrating data over weeks, they almost always depend on the Domain Name System at some point in the kill chain. Yet DNS security remains one of the most underinvested layers in Indian enterprise networks — even as ransomware groups, state-sponsored actors, and commodity malware operators increasingly weaponise it.
This post is a practical guide for Indian IT and security leaders who want to close this gap: understanding how DNS-based attacks work, what a layered DNS security architecture looks like, and how to operationalise it within the constraints of Indian regulatory requirements including CERT-In’s incident reporting directions and the DPDP Act.
DNS is ubiquitous, trusted, and rarely inspected deeply. Firewalls that rigorously block outbound HTTP/HTTPS traffic on non-standard ports will often pass DNS queries without a second look. This makes DNS an ideal covert channel for a range of techniques:
A 2024 industry survey found that over 90 percent of malware families use DNS for C2. For Indian enterprises managing distributed branch offices, remote workforces, and cloud workloads across multiple providers, the DNS attack surface is substantial — and largely invisible without dedicated tooling.
Several structural factors make Indian enterprises particularly exposed:
Many Indian branch offices still use the DNS resolvers assigned by their ISP or leased-line provider. These resolvers offer no malicious domain filtering, no logging, and no integration with threat intelligence feeds. An employee clicking a phishing link or a compromised IoT device beaconing to a C2 server will receive a valid DNS response with no interception.
Legacy enterprise networks in India often use a single internal DNS server (commonly a Windows Server DNS role) for all segments — users, servers, OT/IoT devices, and guest networks. A single compromise on any segment can allow DNS-based lateral movement queries to flow unimpeded to attacker-controlled domains.
CERT-In’s April 2022 directions require organisations to maintain log records for a rolling 180-day period and to report incidents within six hours of detection. DNS query logs are explicitly relevant — they are often the earliest forensic evidence of compromise. Yet most Indian enterprises we assess have either no DNS query logging or logs that are retained for fewer than 30 days with no correlation capability.
Cloud migrations introduce shadow DNS complexity. Developers creating AWS Route 53 zones, Azure Private DNS zones, or GCP Cloud DNS configurations without IT oversight create split-brain scenarios where internal names resolve differently from different network positions — creating gaps that attackers can exploit through DNS rebinding or poisoning attacks.
Effective DNS security is not a single product or configuration; it is a layered architecture. Here is how we structure it for Indian enterprise clients:
The first layer is deploying a DNS resolver that integrates threat intelligence feeds and blocks known-malicious domains before a connection is ever attempted. Modern next-generation firewalls — including FortiGate — provide DNS filtering as a built-in security profile. FortiGuard DNS Security uses Fortinet’s globally sourced threat intelligence to categorise domains into risk categories: botnet C2, malware distribution, phishing, anonymisers, newly registered domains, and more. Security profiles can allow, monitor, or block by category with logging to FortiAnalyzer or syslog.
Key configuration checklist for FortiGate DNS filtering:
DNS Security Extensions (DNSSEC) cryptographically sign DNS records so that resolvers can verify responses haven’t been tampered with. For Indian enterprises hosting public-facing services — banking portals, customer portals, B2B APIs — DNSSEC on authoritative zones prevents cache poisoning attacks that could redirect your customers to fake login pages. India’s .in domain registry supports DNSSEC; if your organisation uses a .in domain, enabling DNSSEC is a low-effort, high-impact hardening step.
Not all network segments need the same DNS policy. A well-architected DNS segmentation model assigns resolver policies by zone:
Threat-intelligence-based blocking is reactive — it only catches what is already known. Anomaly detection catches novel threats. High-entropy domain names (DGA indicators), unusually high query rates per host, DNS tunneling patterns (large TXT records, long subdomain chains, high query volumes to a single domain), and queries to newly registered domains within 24–48 hours of registration are all signals that require correlation and investigation.
This is where operational tooling becomes essential. Analysing DNS telemetry at scale — across thousands of endpoints, multiple sites, cloud workloads, and remote users — requires a platform that can ingest, correlate, and surface anomalies without flooding analysts with noise.
Indian enterprises managing DNS security across distributed environments face a common operational problem: visibility is fragmented across network segments, cloud environments, and remote sites, while analyst capacity is finite. This is exactly the gap that the PrahiX Ora platform — which we deploy and operate for clients — is built to close.
PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner. Here is how each of its four capability pillars directly supports DNS security operations in an Indian enterprise context:
SIEM — DNS Log Correlation and Attack Storyline Reconstruction: PrahiX Ora’s SIEM ingests DNS query logs from FortiGate, Windows DNS Server, Infoblox, Cisco Umbrella, and cloud DNS resolvers alongside endpoint telemetry, firewall logs, and authentication events. Correlation rules mapped to MITRE ATT&CK techniques — including T1071.004 (Application Layer Protocol: DNS), T1568.002 (Dynamic Resolution: Domain Generation Algorithms), and T1048.003 (Exfiltration over Alternative Protocol) — surface attack chains across sources. The platform’s graph-based attack storyline reconstruction links a suspicious DNS query on an endpoint to the process that made it, to downstream lateral movement, to data staging — giving analysts a connected picture rather than isolated alerts. For compliance, tiered log retention (hot/cold/archive) addresses CERT-In’s 180-day in-country log retention direction directly, keeping DNS audit trails available for incident investigation without runaway storage costs.
NMS — Unified DNS Infrastructure Observability: DNS outages are operational crises. PrahiX Ora’s NMS provides unified observability across FortiGate firewalls, Windows DNS servers, internal resolvers, switches, APs, and WAN/SD-WAN links within a single pane of glass. LLDP/CDP topology discovery maps how DNS traffic flows across your estate, while ML-based anomaly detection identifies resolver overload, amplification attack patterns, or unusual query spikes before they escalate. For multi-vendor estates — common in Indian enterprises that have grown through acquisition or run mixed ISP circuits — NOC visibility is no longer fragmented between separate tools: DNS health, network path quality, and device availability are correlated in one view.
Video Surveillance (VMS) — Physical and Network Security in One View: DNS attacks on enterprise infrastructure sometimes coincide with physical security events — an insider exfiltrating data while a camera system is offline, or a network intrusion timed to a facility access event. PrahiX Ora’s video surveillance (VMS) capability manages ONVIF/Hikvision/Dahua cameras with video analytics and brings physical security under the same operational view as network and security events. For manufacturing, retail, and multi-site Indian enterprises, correlating a DNS anomaly with a physical access log entry in the same platform enables investigations that would otherwise span two separate teams and toolsets.
SOAR — Automated DNS Threat Response Within the CERT-In Six-Hour Window: When a DNS-based C2 channel or data exfiltration attempt is detected, the clock starts immediately. CERT-In’s directive requires incident reporting within six hours of detection — a timeline that manual analyst workflows consistently struggle to meet. PrahiX Ora’s SOAR capability uses pre-built playbooks with automated response actions, including pushing updated DNS blocklists and IP blacklists directly to FortiGate firewalls. The moment a confirmed C2 domain is identified, automation pushes a block policy to the NGFW, isolates the affected endpoint, and generates the CERT-In incident report draft — in minutes, not hours. For Indian enterprises where the gap between detection and containment is currently measured in days, SOAR is what makes the six-hour reporting window realistic rather than aspirational.
If your organisation is evaluating unified SecOps platforms for DNS security and broader security operations, we’re happy to walk through what a deployment looks like in an Indian enterprise environment. Reach out to our team for a no-obligation assessment.
Use this checklist as a baseline for your DNS security audit:
India’s regulatory requirements create specific DNS security obligations that IT leaders should address proactively:
CERT-In April 2022 Directions: Organisations must maintain logs of all ICT systems including networks and security devices for 180 days and store them within Indian territory. DNS query logs fall squarely within scope. Organisations must also report cybersecurity incidents to CERT-In within six hours of becoming aware. A DNS-based C2 channel or data exfiltration over DNS that is not detected and contained rapidly can trigger mandatory notification — with potential regulatory consequences for delayed reporting.
Digital Personal Data Protection (DPDP) Act: DNS logs may contain personal data where query patterns can be linked to identifiable individuals (employees, customers). Data fiduciaries should assess whether DNS logs fall within their data inventory, implement appropriate retention and access controls, and ensure logs stored for CERT-In compliance are managed in a manner consistent with DPDP obligations. PJ Networks’ managed security services help clients structure their logging architecture to support compliance with both CERT-In retention requirements and DPDP data minimisation principles — we do not claim that any specific product or configuration makes an organisation “DPDP compliant,” as compliance requires a broader programme of governance, process, and technical controls.
PJ Networks delivers managed DNS security as part of our FortiGate NGFW management and 24/7 NOC/SOC services. For organisations adopting FortiGate, we configure FortiGuard DNS Security profiles as part of our standard hardening baseline, integrate DNS telemetry into centralised SIEM correlation, and monitor for DNS anomalies around the clock. For multi-site Indian enterprises requiring consistent DNS security policy across branches, SD-WAN deployments, and cloud workloads, we deploy unified resolver policies that follow the user regardless of location.
If your DNS security posture is a gap you have been meaning to close — or if a recent incident has made it urgent — our team is ready to help you assess where you stand and build a roadmap that addresses both the technical and regulatory dimensions. Contact PJ Networks to start the conversation.