NIST SP 800-81r3 Secure DNS Deployment Guide

NIST Publications

Published March 19th, 2026

Detected March 21st, 2026

Summary

NIST has published Special Publication (SP) 800-81r3, providing updated guidelines for securing Domain Name System (DNS) deployment. The guide aims to enhance network security by mitigating DNS misuse and misconfiguration, aligning with zero trust and defense-in-depth strategies.

View original document View source feed page

What changed

NIST has released Special Publication (SP) 800-81r3, titled "Secure Domain Name System (DNS) Deployment Guide." This publication offers updated guidance for securing DNS protocols and infrastructure, addressing the evolving threat landscape. It provides strategies to mitigate misuse and misconfiguration, serving as an additional layer of network security within zero trust and defense-in-depth frameworks. Key topics covered include authoritative name servers, DNS logging, DNS Security Extensions (DNSSEC), encrypted DNS, protective DNS, recursive name servers, and resource records.

This guidance is intended for organizations responsible for deploying and managing DNS infrastructure. While non-binding, it provides best practices for enhancing network security and resilience. Compliance officers should review the publication to understand recommended security measures for DNS deployment, particularly concerning encryption, DNSSEC, and protective DNS services, to ensure their organization's network security posture is up-to-date.

What to do next

Review NIST SP 800-81r3 for updated DNS security best practices
Assess current DNS deployment against the guidelines in SP 800-81r3
Implement recommended security measures for DNS infrastructure

Source document (simplified)

PUBLICATIONS

Secure Domain Name System (DNS) Deployment Guide

Published

March 19, 2026

Author(s)

Scott Rose, Cricket Liu, Ross Gibson

Abstract

This document provides Domain Name System (DNS) deployment guidelines to secure the DNS protocol and infrastructure, mitigate misuse or misconfiguration, and provide an additional layer of network security as part of a zero trust and/or defense-in-depth security risk management approach. This introduction briefly discusses relevant context for DNS and examines the changing threat landscape that has warranted an updated approach to DNS deployment. Citation Special Publication (NIST SP) - 800-81r3 Report Number 800-81r3 NIST Pub Series Special Publication (NIST SP) Pub Type NIST Pubs

Download Paper

https://doi.org/10.6028/NIST.SP.800-81r3 Local Download

Keywords

Authoritative Name Server, Domain Name sytem (DNS), DNS Logging, DNS Security Extensions (DNSSEC), Encrypted DNS, Protective DNS, Recursive Name Server, Resource Record (RR) Trustworthy networks, Network security and robustness and Cybersecurity and privacy

Citation

Rose, S.
, Liu, C.
and Gibson, R.

(2026),
Secure Domain Name System (DNS) Deployment Guide, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.SP.800-81r3, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=960578       
  (Accessed March 20, 2026)