Security and regulatory controls

This guide describes DNS by echo reply controls for access, DNS protection, change review, incidents, and activity history. They can support an organisation’s security work, but do not certify compliance or replace its own legal and risk advice.

Available controls

Access and separation of duties

  • six role presets built from 17 permission flags, with risk-assessment sign-off granted separately to named people
  • custom roles for DNS, registration, billing and compliance responsibilities
  • a separate self-approval permission for organisations that require review by another user
  • organisation-scoped access and history views

See Team management and RBAC. Review your actual role assignments. Installing the platform does not configure least privilege for you.

Change and evidence workflows

  • proposed changes can be stashed for review when the acting role cannot self-approve
  • supported management changes create append-protected history records
  • supported history views provide tenant-scoped activity and CSV evidence
  • Enterprise organisation administrators can generate PDF or CSV compliance reports from existing asset, role, change, incident and risk data

Report generation is a presentation of recorded platform data. It is not an auditor opinion or proof that every required process operated effectively.

DNS protection

  • managed online DNSSEC signing and a DS-record workflow
  • direct display of signed records and registrar submission state where the domain is registered through echo reply
  • enabled/disabled state and record-management controls

DNSSEC still requires a correct parent DS record. Follow DNSSEC setup and migration and independently validate the chain of trust.

Incident records

Authorised users can record incidents and track reporting stages. Access to specific compliance views and features depends on role and plan. Your organisation remains responsible for deciding whether an incident is reportable, confirming the applicable rules and deadlines, and making required notifications to authorities.

A practical review

  1. Inventory zones, records, delegations and owners.
  2. Map each role to job responsibilities and remove unnecessary permissions.
  3. Decide which changes require independent approval and restrict self-approval accordingly.
  4. Verify DNSSEC at both the authoritative service and parent delegation.
  5. Review management history and test the exports your role and plan provide.
  6. Document who assesses incidents and makes any regulatory notification.
  7. Test DNS migration and rollback using the migration guide.
  8. Record gaps and owners outside the platform, including supplier review, business continuity and communications.

Claims this guide does not make

This guide does not promise a particular data-hosting region, third-country-transfer posture, audit-log retention period, external certification, regulatory reporting service, or universal availability of multi-factor authentication or single sign-on. Confirm contractual and operational requirements with info@echo-reply.net before relying on them in an assessment.