NIST Finalizes Revision 3 of Its DNS Deployment Guide

Summary: NIST published the final version of SP 800-81 Revision 3, “Secure Domain Name System (DNS) Deployment Guide,” on March 19, 2026. The guide covers DNS as a zero-trust policy and decision input, authoritative DNS integrity protections including DNSSEC, and recursive DNS protections aimed at preserving client-query confidentiality. NIST says the final version also adds clarification based on public comments, including extra text on minimizing information leakage in DNS queries and responses.

Why it matters: DNS is still one of the easiest places for defenders to underestimate systemic risk. NIST’s update matters because it treats DNS as both security infrastructure and a control surface, not just as background plumbing, which is closer to how modern enterprises actually use it.

What to watch: Watch for whether organizations treat this as architecture guidance or just as another reference document that nobody operationalizes. The practical test is whether teams change resolver, authoritative DNS, and logging decisions instead of merely citing the publication in policy decks.

Source: NIST CSRC