Security Operations

Singapore adds national protective DNS to new cyber strategy

Singapore’s 2026 cyber strategy adds a national protective DNS service. How it compares with NCSC PDNS and Early Warning, and what UK teams should do.

Stylised network graphic representing a national protective DNS service blocking malicious domains

Singapore has refreshed its national cyber security strategy, and the headline measure is a nationwide protective DNS service that will stop users reaching known phishing and malware domains. The UK already runs a similar service, so the useful question is what Singapore is doing differently and what that reveals about gaps in UK coverage.

What happened

On 13 October 2026, Senior Minister K Shanmugam opened the 11th Singapore International Cyber Week and launched the Singapore Cybersecurity Strategy 2026. It replaces versions from 2016 and 2021. This version is built on four pillars: defending critical infrastructure, raising protection across the wider digital ecosystem, building capability in AI and quantum, and deepening international partnerships. Two foundational enablers, industry and research development plus the cyber workforce, sit underneath them, and delivery is planned over five years.

The Straits Times reports that the most visible new measure is a national protective domain name service (PDNS). The Cyber Security Agency of Singapore (CSA) will run it from its National Cybersecurity Command Centre (NC3), and it is expected to go live in 2027. Its job is to stop users reaching domains already identified as hosting phishing pages or malware. Shanmugam described the shift as an effort to “act earlier, act at national scale and act at the speed of the threat”.

In her welcome address to the conference, Josephine Teo, Minister for Digital Development and Information, argued that trust in digital systems is getting harder to sustain just as AI makes it more important.

The technical picture

Protective DNS is not new technology. A recursive resolver checks each lookup against a curated deny list and refuses to resolve anything known to be bad, so a click on a phishing link or a beacon from malware towards its command server simply fails. What matters is the quality of the intelligence behind the list, how false positives are handled and who sees the block data.

Singapore has addressed the governance side directly. Blocking will take place under the Online Criminal Harms Act, which came into force in 2024. CSA says each domain will go through an assessment and validation process before it is blocked, and affected site owners can use the Act’s existing reconsideration and appeal routes. The Straits Times notes that an inter-agency Counter Ransomware Task Force recommended PDNS in 2022.

PDNS is one part of a wider NC3 upgrade. Tech Edition’s breakdown lists other capabilities:

  • Attack surface management to find exposed internet-facing assets at critical infrastructure operators, plus vulnerability management to prioritise fixes for severe or actively exploited flaws.
  • Proprietary detection systems built by the Centre for Strategic Infocomm Technologies (CSIT), a Ministry of Defence body, being fitted at selected critical information infrastructure (CII) owners and linked to the NC3.
  • AI-assisted tooling to track live incidents, draft operational assessments and help defenders plan next steps during national-scale responses.

The motivation is clear in CSA’s own figures. The number of malware-infected systems detected in Singapore more than doubled, from 117,300 in 2024 to 284,300 in 2025. Then there was the UNC3886 espionage campaign against its four main telecoms operators, which prompted Operation CYBER GUARDIAN, Singapore’s largest coordinated incident response to date.

Checklist comparing Singapore's new national cyber defence capabilities with the NCSC's PDNS, Early Warning and attack surface work

Why it matters for UK organisations

The Straits Times lists the UK among countries with comparable blocking services. The NCSC’s PDNS is a well-established Active Cyber Defence capability. Cloudflare and Accenture deliver it, the NCSC funds it centrally, and the Cabinet Office requires central government departments to use it. Eligible organisations can use it free of charge. PDNS Roaming extends protection to Windows, macOS and iOS devices off the corporate network using DNS over HTTPS, and block data can flow into Microsoft Sentinel or Splunk through ready-made connectors.

The difference is reach. Singapore is positioning its service as national infrastructure for users, businesses and critical systems. The UK service is tied to eligibility criteria. The NCSC publishes separate guidance for private sector organisations that do not qualify, telling them to buy protective DNS commercially from trusted providers. For many UK businesses, DNS-layer protection is therefore a purchasing decision.

The NCSC also offers Early Warning, a free alerting service. Organisations register their public IP addresses and domains through MyNCSC and receive notifications of malware and vulnerabilities seen on their networks, with the NCSC citing around 2,000 alerts a month across users. On attack surface work, the NCSC published a blog on 12 October asking organisations involved in buying external attack surface management (EASM) tools to help shape future ACD 2.0 services. In the UK that work is still research; Singapore is building it into operations.

Expert view

In my experience, protective DNS is one of the cheapest controls available that actually stops attacks. When we test outbound controls, a well-fed protective resolver often breaks the chain before a payload download or call-back. It is not a silver bullet, since fresh domains, abused cloud services and hardcoded IP addresses slip past, but it removes a lot of commodity noise.

The bigger lesson from Singapore is about joining things up. A blocked lookup on its own is a near miss that nobody notices. Feed it into a SIEM, tie it to an asset and user, and it becomes an early sign of a phished mailbox or infected endpoint. I often find UK organisations that deployed protective DNS and never read the logs, or exempted the servers and remote laptops attackers target first.

Singapore’s plan to put government-built sensors inside CII operators is a step further than UK practice, and raises fair questions about oversight. Shanmugam framed national defence as continuous monitoring and hunting rather than periodic checks. Teo, speaking about AI systems, made a point that applies equally here: “accountability cannot be outsourced.”

What to do now

  1. Check your eligibility for NCSC PDNS. Public sector bodies should check the NCSC’s published eligibility criteria and register via MyNCSC if they qualify. The NCSC says those who qualify should not treat a paid service as a substitute.
  2. Otherwise, buy protective DNS. Private firms should follow the NCSC’s private sector PDNS guidance. Force all resolvers, including those used by servers, cloud workloads and remote devices, through the service, and block direct outbound DNS and unmanaged DNS over HTTPS. This supports the Cyber Essentials firewall and malware protection controls.
  3. Log and alert on blocks. Send PDNS block events to your SIEM, map them to hosts and users, and treat repeat hits as a trigger for endpoint triage.
  4. Sign up for Early Warning. Register every public IP range and domain, keep the contact list current and assign named owners to act on the alerts.
  5. Know your external attack surface. Keep an accurate inventory of internet-facing assets and patch actively exploited flaws first, in line with the Cyber Essentials security update control. Consider joining the NCSC’s EASM research.

Bottom line

Singapore is not inventing anything here. It is making protective DNS, attack surface monitoring and coordinated hunting standard national services rather than optional extras. The UK already offers much of this through Active Cyber Defence, but outside the public sector its coverage depends on each organisation acting for itself. UK teams should make sure DNS-layer blocking and Early Warning are in place, and that their alerts reach someone who will act.

Sources

Related Posts