On October 21, 2016, a botnet of hijacked webcams and DVRs pointed itself at a single DNS provider called Dyn and, for most of a day, took Twitter, Reddit, Spotify, Netflix, PayPal, and dozens of other sites off the internet across the US Northeast and parts of Europe. None of those companies were hacked. Their servers were up the whole time. What went down was the thing that turns a name into an address — and once that broke, the servers might as well not have existed.
That’s the part people miss about DNS. We treat it like plumbing: boring, invisible, someone else’s problem. But it isn’t plumbing. It’s the root of trust that everything above it silently depends on, and it’s the layer we protect the least.
The uncomfortable equivalence
Here is the sentence that should keep you up at night, and it comes almost verbatim from every certificate authority’s own documentation: control over DNS is equivalent to control over certificate issuance.
Think about what that means. When you get an HTTPS certificate today, you don’t prove you own a company or a building. You prove you control the domain. And “controlling the domain” is demonstrated one of two ways: you put a specific file at a URL on the domain (HTTP-01), or you put a specific TXT record in the domain’s DNS (DNS-01). Both of those are things anyone who has seized your DNS can do in about ninety seconds.
So the attacker who takes over your DNS doesn’t have to break TLS. They don’t need a stolen private key or a quantum computer. They point your domain at their own server, ask Let’s Encrypt for a certificate, pass the validation check they now control, and receive a certificate that every browser on earth will show with a padlock. It is not a forged certificate. It is a real one, issued to the rightful process, for a domain the attacker temporarily owns. The whole edifice of web encryption rests on the assumption that DNS answers are honest, and we almost never check whether they are.
The industry has started to notice. As of March 2025 the CA/Browser Forum requires “multi-perspective issuance corroboration” — CAs now validate domain control from several geographically separated vantage points before issuing, specifically so a localized BGP or DNS hijack can’t fool the check from one location. That’s a real improvement. It’s also an admission of exactly how load-bearing DNS turned out to be: we had to bolt on a distributed sanity check because the single check was one hijack away from minting valid certificates for anyone.
Email is worse
TLS at least gets attention. Email routing gets none.
Where your mail goes is decided by an MX record — a DNS record. Whoever edits that record decides which server receives every message sent to your domain, including the password-reset emails for every account your company holds elsewhere. There is no handshake protecting this, no certificate the sender validates by default. SMTP was designed in an era of mutual trust, and the layer that tells the world where to deliver your mail is the same unauthenticated DNS that told those webcams where Twitter lived.
MTA-STS and DANE exist to harden this. Almost nobody deploys them. So for the overwhelming majority of domains, the answer to “who receives your email” is “whoever last controlled your DNS,” full stop.
We built a lock and never used the key
The maddening thing is that the fix has existed for over twenty years. DNSSEC signs DNS records cryptographically, so a resolver can detect a forged answer. It’s the closest thing DNS has to the certificate model that secured the web.
Nobody uses it.
The numbers are genuinely embarrassing. As of 2026, roughly 8% of domains are signed with DNSSEC — a figure that has crept up by about one percentage point in the last year and looks flat again. End-to-end DNSSEC validation, the part that actually protects a user from a forged record, sits under 1% of queries. Twenty-plus years after standardization, the mechanism designed to stop exactly the attack that makes DNS the weakest link is deployed on fewer than one domain in twelve.
There are real reasons. DNSSEC is operationally sharp-edged: a botched key rollover or an expired signature doesn’t degrade gracefully, it takes your whole domain offline with a SERVFAIL, which means the failure mode of “I tried to be secure” looks identical to “I am now down.” Registrars made it opt-in and buried it. The tooling was miserable for a long time. All true. But strip away the excuses and you’re left with a blunt fact: the one layer that everything else trusts is the one layer we chose not to authenticate.
Why this keeps not mattering until it suddenly does
DNS is the weakest link precisely because it’s the least dramatic one. A leaked database makes headlines. A DNS record quietly changing for four hours at 3 a.m. does not — until someone notices their traffic was rerouted, their certificate was reissued to a stranger, and their mail took a detour through a server they’ve never heard of.
The dependency graph of the modern internet has a single unglamorous root, and we’ve spent two decades securing everything except that root. The certificates are strong. The ciphers are strong. The passwords are getting stronger. And all of it hangs from a lookup we assume is telling the truth.
Check your DNS the way you’d check a lock on the front door, because functionally that’s what it is — the door everything else is behind. Know who can edit your records. Know what your MX points to. And if you’re one of the eleven-in-twelve domains that never signed, at least make the decision on purpose instead of by neglect.