Domain Name System (DNS)

Applies to. DNS reaches PCI DSS through scoping rather than through a control of its own. The standard's scoping section lists DNS servers among the server types that count as system components, and lists name resolution among the services that can affect the security of the CDE even when they never touch account data. So the resolver a CDE host uses is a system component in scope, not background plumbing. DNS traffic is also a service, protocol and port that needs identifying, approving and justifying under 1.2.5, and an outbound allow rule from the CDE under 1.3.2.

Example. A merchant's card-data servers resolve names through an internal DNS server that forwards to the internet. An attacker who poisons that server's cache can send the payment application's outbound calls to a look-alike host. Because the resolver can redirect CDE traffic, it is a system component in scope: it gets the same hardening, patching and logging as the servers that rely on it, and its outbound DNS traffic is a justified allow rule in the CDE's deny-by-default egress under 1.3.2.

Limits. DNS is not a security control and PCI DSS has no requirement on how to run it; it appears through scoping and through the general rules on services, protocols and hardening. Name resolution also gives no assurance about the identity of the host reached: matching a name to an address is not the same as authenticating the server, which is the job of TLS certificates. And a domain name on a payment page does not tell the assessor where the page is served from or by whom; the data-flow diagram and network diagram do that.