DNS, the Domain Name System that turns names into addresses, keeps records long after the projects that needed them are gone, and attackers know which ones to look for. I worked at Network Solutions in the 1990s, when a record was a line someone typed and left alone. On September 29, 2026, Amazon Web Services announced general availability of Palo Alto Networks Advanced DNS Security inside Amazon Route 53 Resolver DNS Firewall across 32 of its Regions (Amazon Web Services, 2026). Palo Alto Networks published its own announcement on October 9.

Attackers use DNS because every network has to allow it.

DNS threats fall into four families, and each family hides in a different place

The detection catalog Palo Alto Networks publishes and the abuse research from Infoblox describe overlapping threats. Four families cover them:

• Hidden communication. Malware takes commands from controller domains, and machine-generated names help it dodge blocklists. Tunneling packs stolen data into ordinary-looking queries.
• Fresh or fake domains. Attackers register a domain and use it within days, before reputation systems notice. Palo Alto Networks treats a domain registered in the past 32 days as newly registered (Palo Alto Networks, 2026). Lookalike names such as "micros0ft" and long-dormant domains woken up for a campaign belong here too.
• Hijacked real domains. A record that points to a deleted cloud resource lets someone else claim your subdomain, and a domain can map to a reputable address before switching to an attacker's.
• Infrastructure abuse. Fast flux rotates the addresses behind a domain, and redirect networks pass victims through chains of domains that outlast any single block.

Palo Alto Networks and AWS moved the checkpoint to where every query goes

Inside AWS, workloads send DNS queries to Route 53 Resolver. Before this launch, inspecting those queries with a Palo Alto Networks firewall meant deploying firewalls across virtual private clouds and accounts. The company's documentation says the integration removes that overhead, along with the routing changes and the forwarding of DNS traffic to external inspection points.

Firewall vendors are part of this story, and Palo Alto Networks is the proof: it sells firewalls, and here it delivers its threat intelligence to the checkpoint your queries pass through.

You subscribe from the Route 53 DNS Firewall console through AWS Marketplace, then write rules that pair threat categories with a block or alert action.AWS License Manager shares the subscription across accounts, and AWS Firewall Manager distributes the rule groups.

Detectors run at three speeds, and only the fastest sits in the resolution path

Inline detectors return verdicts as the query resolves. They match known malicious domains and flag generated names and tunneling. If a domain generation verdict has not returned within 4 milliseconds, the query resolves as usual, which keeps your workloads available (Palo Alto Networks, 2026).

Real-time detectors watch queries off the path and raise signals within seconds, covering advanced tunneling and fast flux. Offline detectors study domain patterns over longer windows to find squatting and phishing domains.

Detectors feed categories, and you select categories when you write rules. Each category carries a business decision. A partner's new website and an attacker's new campaign can sit in the same 32-day window, so starting a category in alert mode shows what a block would have caught before it blocks anything.

Palo Alto Networks says the integration inspects internet-bound queries, and internal names resolved inside your virtual private cloud fall outside its scope.

Other vendors cover the queries AWS never sees

Protective DNS services such as DNSFilter and Cisco Umbrella filter at name resolution for offices and laptops. Cloudflare Gateway and Quad9 do similar work, and Infoblox pairs DNS infrastructure with threat defense.

Microsoft applies the same idea inside Azure virtual networks. Its Azure DNS Security Policy uses a threat intelligence feed from the Microsoft Security Response Center that you can run in alert-only or blocking mode.

Resolution-level tools see a domain name and a record type before any connection exists, so web gateways add URL and file inspection on top. That is the argument in a comparison from dope.security, a web gateway vendor.

The origin of your queries decides which tool sees them. AWS workloads use Route 53, so Route 53 DNS Firewall is where policy lands for them, and hybrid traffic forwarded through Resolver endpoints reaches the same rules.

Your own domains carry loose ends no vendor can close

Palo Alto Networks lists detections for stale records on your public domains and for deleted domains that attackers can register. A detection can flag a stale record, but deleting it takes someone on your team.

Any record you forgot to delete is a subdomain someone else can claim.

Eight habits keep a domain portfolio clean:

1. Inventory every domain, including acquired and campaign domains, under one named owner.
2. Turn on auto-renew and expiry alerts, because attackers re-register expired names that other pages still link to.
3. Delete the DNS record in the same change that retires the cloud resource it points to.
4. Compare your zones against live cloud inventory on a schedule and flag records that point to nothing.
5. Protect registrar and DNS provider accounts with multi-factor authentication and least-privilege roles, and add registry locks to core domains.
6. Route every DNS change through a ticket or infrastructure as code so each record has an owner and a reason.
7. Remove retired vendors from your Sender Policy Framework record and review old signing keys.
8. Watch certificate transparency logs for certificates issued on your names that you did not request.

Treat the list as a standing review with a named owner, because a one-time cleanup starts going stale the day it finishes.