SC-20(2) — Data Origin and Integrity

Provide data origin and integrity protection for DNS data specifically — ensuring responses are authentic and complete.

Example 1: Enable DNSSEC validation on your recursive resolvers so they verify the cryptographic signatures on DNS responses before passing them to clients. Invalid signatures cause the query to fail rather than return potentially poisoned data.

Example 2: Monitor DNSSEC validation failures in your DNS server logs and forward them to your SIEM. A spike in validation failures could indicate a DNS poisoning attack or a misconfigured upstream zone.