DNS controls are policies and technical safeguards that govern how hostnames are resolved into IP addresses. They can include allowlists, blocked domains, filtering resolvers, sinkholing, and split-horizon DNS rules that return different answers based on context. In practice, they help decide which destinations are reachable and which should be denied or rerouted.
These controls matter because many attacks depend on trusted software making outbound connections to attacker-chosen hosts. In server-side request forgery, malware callbacks, and data exfiltration, DNS checks can stop a request before it reaches a sensitive internal service or an external command-and-control server. Defenders should treat DNS controls as one layer, not the only boundary: validate destinations in the application, enforce egress filtering at the network, and verify the actual transport path, because some clients can bypass name-resolution checks through alternate routes.