> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.
# DNS layer (DN)
- URL: /taxonomies/email-infrastructure/dns-layer/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-11-02T17:53:02.112Z
- Description: DNS layer (DN): 13 threats in the email infrastructure threat taxonomy. The records and resolvers that say where mail goes and who may send it.
- Author: Brett Crawley
[Taxonomies](/taxonomies/) › [Email infrastructure](/taxonomies/email-infrastructure/) › DNS layer
**Layer 06 of 09 · 13 threats · prefix DN**
DNS decides where mail goes and who may send it, so whoever controls or falsifies an answer controls the mail. These entries cover the records the platform publishes, hosts for tenants and resolves.
**Scope:** The records and resolvers that say where mail goes and who may send it.
*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/email-infrastructure/) on the overview page, where it can be searched and copied.*
## The threats
- **EM-DN-A** MX Redirection
- **EM-DN-K** Dangling Mail Records
- **EM-DN-Q** Unauthenticated Answers
- **EM-DN-J** Transport Policy Downgrade
- **EM-DN-10** Domain Lifecycle Gap
- **EM-DN-9** Weak Ownership Verification
- **EM-DN-8** Resolver Trust
- **EM-DN-7** Lookup Amplification
- **EM-DN-6** DNS Failure Semantics
- **EM-DN-5** Reputation Feed Dependency
- **EM-DN-4** Cached Policy Poisoning
- **EM-DN-3** Signing Failure Outage
- **EM-DN-2** Internationalised Domain Confusion
## Where this layer touches others
- **Authentication and DNS:** DNS covers who can control or falsify an answer. Authentication covers what a genuine answer can be made to mean.
- **Operations and the other layers:** delivery pipeline, client protocols and DNS each cover a corner of operations (admin routing changes in EM-DP-2, mailbox state in EM-CP-10, dangling records in EM-DN-K). Operations and storage covers the stores and tooling around the message path: the copies, the credentials and the people with access.
## STRIDE, CAPEC and CWE
Of the 13 entries here, STRIDE fits 9 cleanly and 4 only loosely. CAPEC 3.9 has a pattern that describes 6 of them directly, only a generic parent pattern for 3, and nothing for 4. CWE 4.20 names the weakness directly for 7, has only a broader weakness for 3, and nothing for 3. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Email Threat Taxonomy to STRIDE, CAPEC and CWE](/email-threat-taxonomy-mapping). The Excel, SKOS and STIX downloads carry the same mapping as text.
---
← [MIME and S/MIME (MI)](/taxonomies/email-infrastructure/eoef-mime-and-s-mime/) · [Email infrastructure overview](/taxonomies/email-infrastructure/) · [Content scanners (CS)](/taxonomies/email-infrastructure/eoef-content-scanners/) →
*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [email infrastructure overview](/taxonomies/email-infrastructure/).*