NIST Updates DNS Security Guidance After 12 Years with SP 800-81r3

NIST SP 800-81r3 modernizes DNS security guidance by treating DNS as an active security control and emphasizing protective DNS deployment (cloud/on‑prem), encrypted DNS management (DoT/DoH/DoQ), updated DNSSEC algorithms and key management (ECDSA, Ed25519, RSA-SHA256), and operational/architectural best practices to reduce risks like dangling CNAMEs and lame delegations; the update is guidance for executives and operators rather than a report of an active cyber incident.