DNS translates names into IP addresses, and DNS security protects that lookup from tampering, spoofing and redirection. A compromised lookup can send a device to an attacker’s server while the address on screen looks correct. Filtering, signed records and monitoring of unusual queries are the usual controls.
Most people never see DNS work. That is exactly why a manipulated lookup is useful to an attacker: the device behaves normally and reaches the wrong place.
Why the lookup is a target
If a recorder resolves a vendor update host to a false address, it can download a malicious file with no visible change. Spoofed responses and poisoned caches are the classic methods. The lookup happens before the connection, so protection has to sit at the resolver.
Controls that help
Use a trusted internal resolver, enable signed records where the zone supports them, and block lookups to known malicious domains. On a camera network, restrict which devices may resolve external names at all. Log unusual queries, because repeated failures are often the first sign of a misconfiguration or an attack.
Related:Commercial securityGlossary: NVR