DNS Monitoring for Cyber Essentials

Where DNS Fits in Cyber Essentials

The scheme's five controls — firewalls, secure configuration, security update management, user access control, and malware protection — are assessed across your internet-facing infrastructure. Your DNS records define what that internet-facing infrastructure is: which hosts are exposed, where email flows, and which services answer under your name. An honest scoping exercise starts with an accurate picture of your DNS estate, and an honest security posture notices when it changes.

How ZoneWatcher Helps

Secure Configuration, Continuously Verified

Cyber Essentials certifies your configuration at a point in time; ZoneWatcher watches it afterwards. Continuous monitoring of DNS records, nameservers, and certificates means configuration drift — a forgotten subdomain pointing at a decommissioned host, an unexpected new record — is flagged instead of accumulating until your next assessment.

An Accurate Scope, Automatically

The self-assessment questionnaire asks you to declare your internet-facing services, and Cyber Essentials Plus adds hands-on testing of them. ZoneWatcher's auto-discovered record inventory across all your DNS providers gives you a complete, current answer — no forgotten test subdomains surfacing mid-assessment.

Detecting What the Five Controls Can't

Cyber Essentials hardens your systems, but DNS hijacking attacks your name, not your servers — compromised registrar credentials or a poisoned record sidestep every one of the five controls. Real-time change alerts cover this gap, protecting the certification-holder's reputation the scheme is meant to signal.

For MSPs Certifying Client Fleets

If you shepherd clients through Cyber Essentials annually, ZoneWatcher gives you per-client DNS inventories for scoping, change alerts between assessments, and exportable reports when the certification body — or the client's customer — asks what changed. One dashboard across every client's providers.

Beyond the Baseline

Cyber Essentials is deliberately a floor, not a ceiling — the NCSC itself encourages layering additional monitoring on top. DNS and certificate monitoring is one of the highest-leverage additions: it's inexpensive, it requires no agents or infrastructure changes, and it watches the layer that decides whether your customers reach you or an impersonator. For organizations stepping up from Cyber Essentials toward ISO 27001, the same evidence feeds directly into the logging and monitoring controls that certification requires.