As a securing consultant, what are some of the things you would recommend to a company to ensure DNS security?

Using the same machines for DNS and other applications increases the attack surface and potential for compromise; it is a poor security practice.

Hardening DNS servers involves applying security updates, configuring least privilege, removing unnecessary services, and securing the operating system, significantly reducing the attack surface.

Using split-horizon DNS (also known as split-brain DNS) involves maintaining separate DNS views for internal and external networks, preventing internal network information from being exposed to the internet.

Restricting zone transfers prevents unauthorized parties from enumerating all hostnames and IP addresses within a domain, which could be used for targeted attacks.

Having subnet diversity between DNS servers, often achieved by deploying them in different network segments or availability zones, enhances resilience against network-based attacks and outages.