Abstract: Provided herein are systems, methods, and software to manage DNS requests to DNS servers. An exemplary method includes, in response to determining a secure DNS server is unavailable, transmitting DNS requests to a local DNS server and generating one or more connections to addresses returned by the local DNS server in response to the DNS requests. The method also includes caching information about the DNS requests in a cache and, in response to determining the secure DNS server is available, sending the information from the cache to the secure DNS server. The secure DNS server processes the information to determine whether a portion of one or more connections is potentially malicious. In response to the secure DNS server indicating the portion of the one or more connections is malicious, the method includes terminating the portion of the one or more connections.

Abstract: Systems, methods, and software are included herein to manage domain name system (DNS) requests to DNS servers. In one implementation, a computing device joins a local network and identifies a connection to a first DNS server associated with the local network. The computing device further implements first DNS rules based on the connection to the first server and monitors when a second DNS server is available using the local network. When the second DNS server becomes available, the computing device implements second DNS rules in place of the first DNS rules, wherein the second DNS rules direct DNS requests to the second DNS server in place of the first DNS server.

Abstract: The technology disclosed herein enables remediation of outlier DNS requests using tiered remedial actions. In a particular example, a method provides grouping DNS requests into one or more groups based on characteristics of the DNS requests and identifying an outlier request of the DNS requests. The outlier request is one of the DNS requests that is not included in the one or more groups. The method further provides determining a remedial action from tiered remedial actions for the outlier request based on a distance of the outlier request to the one or more groups. The tiered remedial actions correspond to different distances. The method provides performing the remedial action.

Abstract: The technology disclosed herein enables identification of outlier DNS requests so the identified requests can be inspected to determine whether the identified requests may be associated with suspicious activity. In a particular example, a method provides determining characteristics of a Domain Name System (DNS) request and generating a score for the DNS request from the characteristics. The method further provides grouping a plurality of DNS requests into one or more groups based on a plurality of DNS request scores for the plurality of DNS requests. The plurality of DNS requests occurred in a specified timeframe and include the DNS request. The plurality of DNS request scores includes the score. In response to determining the DNS request is an outlier relative to the one or more groups, the method provides inspecting the DNS request for anomalies.

Abstract: Systems, methods, and software for monitoring deviations from DNS request trends in a computing environment. In one example, a monitoring service identifies baseline information associated with DNS requests in a computing environment based on DNS requests during a baseline period. The monitoring service further monitors DNS request information associated with additional DNS requests in the computing environment and determines when the additional DNS requests satisfy criteria demonstrative of a deviation from the baseline information. Once the criteria are satisfied, the monitoring service performs an action remediate the deviation.

Abstract: Systems, methods, and software are included herein to manage domain name system (DNS) requests to DNS servers. In one implementation, a computing device joins a local network and identifies a connection to a first DNS server associated with the local network. The computing device further implements first DNS rules based on the connection to the first server and monitors when a second DNS server is available using the local network. When the second DNS server becomes available, the computing device implements second DNS rules in place of the first DNS rules, wherein the second DNS rules direct DNS requests to the second DNS server in place of the first DNS server.