As the administrator of .be, .vlaanderen, and .brussel domain names, DNS Belgium sits at the heart of the Belgian internet. Reliability, stability, and independence are part of its DNA.
Anyone visiting a website only sees the tip of the internet iceberg. Behind the visual interface lies a complex network of domains that guide visitors to the right address. DNS Belgium oversees all domains ending in .be, .vlaanderen, and .brussels. Keeping those millions of domains safe and online is part of CISO Kristof Tuyteleers’ daily responsibilities.
For an organization at the heart of the Belgian internet, security is a top priority. After seventeen years of service, Tuyteleers knows DNS Belgium like no other. Yet, these are exciting times for him: DNS Belgium is about to leave the AWS cloud, while European regulations continue to raise the bar.
ITdaily: What does the IT environment you are responsible for look like?
Tuyteleers: “I’ve been with the organization for seventeen years now. Back then, we still managed our own infrastructure layer. Today, we have a piece of traditional IT, but the ‘sexy’ part is obviously the DNS environment. Our critical infrastructure must always work. This is truly the organization’s crown jewel.”
“Our DNS infrastructure has become much more extensive over the years. We collaborate with larger ISPs to strengthen resilience. We run a copy of our service within their network; customers can only use that copy. This guarantees the service remains available, even if there are technical problems on the internet. It’s a niche, but it aligns with how the ‘old’ internet worked.”
“Our registration platform is a different story. This is where we register who owns a domain name and the technical indicators. The challenges there are mainly policy-driven: a domain name cannot simply be handed over. The teams are organized into different clusters with clear responsibilities.”
What are your top priorities right now?
Tuyteleers: “Stability and reliability: that is our reason for being. Legislation plays a major role in this: GDPR for the registration platform, followed by NIS1, and now NIS2 and CER because we fall under critical infrastructure. We must be able to continuously demonstrate that we are compliant. Phasing out non-European technology is a new strategic priority.”
We are a ‘boring’ company in the best sense: if .be domains don’t work, services are unreachable. Contrary to what is often thought, we are not a government company, but a small non-profit. But we can never go down. At any moment, we must be able to show that everything we do stems from identifying and managing risks. That is crucial for maintaining relationships with stakeholders.
Does the rest of the organization understand these priorities sufficiently? How do you get everyone on the same page?
Tuyteleers: “For me, that’s actually relatively ‘easy’ because we are a risk-averse organization. Risk management is in our DNA and flows through the entire organization, starting at the top. My role is to make the risk landscape clear to people. At the highest level, that goes broader than just risks; it’s about how the entire internet landscape is evolving.”
“We regularly perform an impact analysis, where we determine the ‘maximum acceptable’ downtime and recovery time for each service and product, such as .be, .vlaanderen, and .brussel. During annual crisis exercises, we then validate whether those timings are actually met.”
“The advantage of a small organization is that the lines of communication are short: we’re all here together in Leuven. For every change, we conduct a risk analysis that is filled out by various departments. This way, everyone is actively involved. The fact that everyone plays a role in security is constantly emphasized.”
Does the IT department have access to enough people and resources to successfully complete the challenges?
Tuyteleers: “There’s always room for more, of course (laughs). What characterizes our sector is the international exchange of knowledge. We are a member of the European association for national domain registries. If we don’t have the knowledge ourselves or have doubts about something, we don’t have to go to a commercial partner. We aren’t competitors, but rather ‘co-opetitors’ who can speak openly with one another.”
“We don’t have all the expertise in-house permanently. That’s why initiatives like sharing threat data and benchmarking against maturity models are valuable to us. There is no competitive advantage in not sharing that information. We also encourage colleagues to be active locally in interest groups such as Beltug.”
Is the future of DNS Belgium’s IT environment in the cloud, on-premises, or a combination of both?
Tuyteleers: “That depends on the nature, risk profile, and legal framework of the IT service. We will always run the DNS infrastructure ourselves, in data centers in Belgium and Europe. We did outsource the underlying infrastructure for the registration platform to AWS at the time. That has been containerized for a while now and can, in principle, run anywhere—on our own hardware, the cloud, or hybrid infrastructure.”
“The decision to leave AWS was made to maximize our flexibility. We are small, so we must ensure we are agile with the people and resources we have. That means being proactive in every area and not waiting around. Otherwise, you’re only busy meeting deadlines, and we don’t want that. By doing our homework on time, we leave room for other matters like security, sustainability, and operational improvement.”
What impact do regulations like NIS2 have on IT policy?
Tuyteleers: “We chose to use both ISO certification and implement the CCB’s Cyfun standard to comply with NIS2. The ISO certification was one of my first major projects. Historically, we were already strong in technical security, but less so in procedures and documentation. That’s extra work, but it provides clarity.”
“The biggest challenge for us lies in the supply chain: how do you keep that under control as a small entity? That’s why we are also looking for a compliance officer. That doesn’t belong in the CISO role: the CISO helps determine policy, but you need someone to handle the ‘checks & balances’.”
“For us, it’s not about being doubly compliant, but about putting things to the test. ISO is a management standard that says little about technical implementation. There are additional obligations for our sector. Technical people want black and white, but legislation is often gray. The core of my job is precisely to translate those standards into workable frameworks that technical teams can use. Our goal is for .be to remain a safe haven for domain names and websites.”
How is your organization handling the AI hype?
Tuyteleers: “I look at it as a hype, but from a pragmatic perspective. We have an AI working group with interested colleagues. First, we look at the legal framework: what is allowed and what isn’t, and does that have an impact on how we would use AI?”
“It’s important that your policy doesn’t come from an ivory tower but starts from the needs of your people. This helps limit ‘shadow IT’. You might never be able to avoid it 100 percent, but by inviting people to help determine the policy, we hope they will be less inclined to go that route.”
“In addition, we use machine learning for fraud prevention, but we build that ourselves. We also exchange knowledge and research on this with, among others, the Dutch domain registry via R&D working groups. We also benefit from surrounding countries being and remaining safe havens. Citizen trust in the .be domain is high, but if neighboring countries’ domains have a lot of fraud, it will reflect on us too. We want to keep Belgian society safe.”
Which important trends are you following with an eye on the next three years?
Tuyteleers: “Our own move away from AWS is at the top of the list. But I’m curious to see how the landscape itself will evolve. Our migration project is attracting interest from companies facing the same questions and from regulators. The impact of major cloud providers on the internet is significant, as recent outages demonstrate. The momentum is there to execute a plan that has existed for a long time. Can the European sector catch up?”
“I am convinced that the knowledge is definitely there, but we urgently need to ask ourselves whether we want to build out data centers and infrastructure to bring workloads back to Europe, or whether all capacity should go to AI infrastructure? Personally, I hope for the former, because I sincerely believe it’s possible. But then you can’t wait too long, or the knowledge will have vanished. This is an interesting moment to rethink dependency. Current geopolitical developments show me that we have started the right move.”
The momentum is there to reduce dependency on non-European technology.