Risk: DNS poisoning and tunneling bypass security controls. Explore cache poisoning, tunneling, DoH/DoT, and DNSSEC protection.
Understand DNS trust, how poisoning works, tunneling techniques for exfiltration, and how modern protocols and DNSSEC mitigate risk.
Run controlled poisoning attempts, generate tunneled traffic, test policy controls, and enable DNSSEC validation.
Harden resolvers, restrict egress, monitor anomalies, and implement DNSSEC with alerting.