DNS Threat Exposure Calculator

Formula used

The calculator builds two indices on a 0–100 scale: Pressure Index estimates risky DNS patterns, and Control Index estimates protective strength.

• Pressure Index uses volume, uniqueness ratio, new domains, NXDOMAIN, risky TLD share, recent incidents, resolver exposure, and TTL risk.
• Control Index uses DNSSEC validation, logging coverage, threat intelligence, encrypted DNS, RPZ, sinkholing, policy strength, and observed blocking.

Risk levels map to score bands: 0–24 Low, 25–49 Moderate, 50–74 High, 75–100 Critical.

How to use this calculator

1. Pull a one-day window of resolver logs or DNS dashboard metrics.
2. Enter query counts, churn indicators, and outcome rates.
3. Select control settings that match your real deployment.
4. Review the score, level, and recommended actions.
5. Export CSV or PDF for audits and tracking.
6. Recalculate after policy changes to measure improvement.

Telemetry inputs that shape exposure

Daily query volume, unique domains, and churn indicators describe your attack surface. Many enterprises see 1–5 million queries daily, with 1–10% unique domains. Newly seen domains above 10% often correlate with malware delivery, while NXDOMAIN rates above 10% can suggest DGA activity or misconfigurations. Risky TLD share, average TTL, and confirmed DNS incidents add context so the score reflects both scale and volatility.

Reading the pressure index

Pressure is log scaled for volume, so growth from 100k to 1 million queries matters more than growth from 10 to 11 million. The index also reacts to behavioral shifts: increasing new domains from 5% to 10% can raise pressure by roughly 7–10 points, depending on uniqueness and NXDOMAIN. Use the index to compare days, sites, or business units, not to label a single domain.

Control signals that lower exposure

Controls measure how quickly you can detect and stop malicious lookups. Target 85–95% logging coverage for reliable investigations, and keep intelligence coverage “high” when feeds are fresh and tuned. DNSSEC validation reduces cache poisoning risk, while RPZ and category policies shorten time to block. Sinkholing improves containment and triage, and encrypted DNS is most valuable when endpoint trust and resolver policy are enforced.

From score to response workflow

The exposure score blends 65% pressure with 35% control gaps, then applies a small model adjustment. Low (0–24) supports routine monitoring. Moderate (25–49) merits monthly tuning. High (50–74) should trigger weekly policy review, hunting on new domains, and tighter blocking. Critical (75–100) suggests immediate hardening sprints, executive reporting, and rapid incident playbooks. Export CSV or PDF to document decisions.

Benchmarking and continuous improvement

Recalculate after any resolver change, policy update, or major incident, then track trends over time. A practical target is a 10–15 point score reduction within one quarter by raising logging, improving intelligence precision, and reducing churn from unmanaged devices. Compare pressure and control indices to see whether improvements come from safer behavior or stronger defenses. Use consistent data windows, ideally 24 hours, for clean comparisons. Pair results with ticket counts to validate improvements against real operational workload changes.

FAQs

What data sources work best for inputs?

Use recursive resolver logs, DNS firewall dashboards, SIEM summaries, or cloud resolver analytics. Prefer a consistent 24‑hour window. If you lack one metric, estimate it from a representative sample and note the assumption in exports.

How do I estimate newly seen domains and unique domains?

Count domains not observed in your prior baseline period, such as seven days. Unique domains are distinct FQDNs or registrable domains, based on your reporting style. Use the same counting method every time to keep trends comparable.

Why can blocked queries affect both risk and controls?

High blocking can reflect strong enforcement, but it may also indicate active attacks. The calculator treats blocking as a limited control signal up to about 5%. Pressure still rises when churn and NXDOMAIN are elevated.

Does encrypted DNS always lower exposure?

Not by itself. Encrypted DNS reduces interception, but exposure stays high if policy enforcement, logging, and intelligence are weak. Use encrypted DNS alongside managed resolvers, endpoint trust, and centralized visibility for measurable reduction.

How often should I recalculate the score?

Recalculate monthly for trend tracking, and immediately after policy changes, resolver migrations, or incidents. Comparing the same weekday patterns can reduce noise. Store CSVs to build a baseline and measure improvement targets.

Can I use this across multiple sites or tenants?

Yes. Run separate calculations per site, network segment, or tenant, then compare pressure and control indices. Standardize data windows and definitions first. Use the recommendations list to create site‑specific hardening backlogs.

Example data table

Examples are illustrative. Replace with your measured DNS telemetry.