DNS is the naming system that translates human-readable domain names into IP addresses so devices can connect to services on a network. Every web request usually starts with a DNS lookup, which makes DNS one of the most useful visibility points for defenders.
In cyber security, DNS matters because attackers can hide command-and-control, phishing, or malware delivery behind domains that look ordinary or low risk. A suspicious domain resolution can be an early hunting signal, but it does not by itself prove compromise; analysts must correlate it with host activity, timing, script execution, and other telemetry. Defenders also watch for unusual patterns such as repeated lookups, rare domains across many hosts, or CNAME chains that obscure where infrastructure really leads. Because DNS is both necessary and noisy, it is a common place for attackers to blend in and for security teams to catch them.