Axon Shield

Why Your Akamai WAF Blocks Nothing: The DNS Routing Hole, Origin Exposure Gap, and Certificate Sprawl Problem

Most Akamai WAF deployments fail to give customers maximum value for their money. Configurations are usually done by Akamai support (part of the Akamai contracts) who are unlikely to be critical to the way you use their service - unless you listen carefully. Effective implementation requires DNS integration, origin hardening, WAF configuration process, and certificate renewal coordination. If not handled properly, Akamai protection remains limited to one or to websites. Unable to give customers visibility of attacks launched against their services.

Your Perimeter Defense Has a Bypass Route You're Not Monitoring

Enterprise security teams deploy Akamai Web Application Firewall expecting comprehensive protection. Default configurations enable Adaptive Security Engine rules. Dashboards report billions of blocked requests. Executive presentations show declining threat metrics.

Then a DNS misconfiguration allows attackers route traffic around this edge protection entirely.

At a regulated company, we found more than 90% of internet traffic taking paths that circumvented Akamai platform completely. The traffic flowing through Akamai had only WAF monitoring, i.e., attacks were not blocked but reported - by Akamai's SOC teams the next day. Not because Akamai failed - because it doesn't become central to clients' protection to provide real-time data for their infrastructure intelligence. DNS routing, origin server exposure, and certificate dependencies created bypass routes the security architecture never accounted for.

The company had deployed Akamai to protect a handful of main services. Everything else: exposed. Expanding to full perimeter protection required addressing three architectural gaps that most enterprises ignore:

Gap 1: DNS Operates Independently from Edge Security

Industry research confirms 79% of organizations face DNS-based attacks,1 yet DNS and WAF operate as isolated systems in most enterprises. When attackers use DNS tunneling for data exfiltration or Domain Generation Algorithms for command-and-control traffic, perimeter defenses never see the activity.

Your WAF evaluates HTTP requests. DNS attacks don't generate HTTP requests.

The more fundamental problem: DNS routing decisions determine whether traffic reaches your WAF at all. A single A-record pointing to origin servers creates a bypass route. Historical DNS records cached by internet archives reveal IP addresses from previous configurations. Attackers don't break through your perimeter - they route around it.

Gap 2: Origin Servers Remain Exposed After Edge Deployment

Enterprise security architectures assume edge protection eliminates the need for origin hardening. "Traffic flows through Akamai, so origin servers don't need defensive capabilities."

This assumption fails when origin server IP addresses become publicly discoverable through:

  • DNS enumeration of forgotten subdomains
  • SSL certificate Subject Alternative Names visible in transparency logs
  • Email server headers revealing infrastructure topology
  • Historical DNS records preserved in internet archives

Once attackers identify origin IPs, they probe directly. Edge protection never sees the reconnaissance traffic. Security dashboards report normal activity while infrastructure mapping proceeds undetected.

In operational audits, we find exposed origin infrastructure in three out of five enterprise deployments. The perimeter defense investment becomes irrelevant when attackers have documented bypass routes.

Gap 3: Certificate Management Operates Outside Security Coordination

Organizations treat certificate lifecycle management as separate from security operations. This creates cascading failures:

Certificate expiration behind WAF generates failed SSL handshakes. WAF interprets connection failures as potential attacks and triggers alerts. Security teams investigate, find expired certificates, escalate to infrastructure teams. Pattern repeats dozens of times annually.

After extended exposure to certificate-driven false positives, security operations develop alert fatigue. When real attacks trigger similar WAF signatures, response delays because the pattern "looks like another certificate issue."

Certificate validity periods are decreasing industry-wide. Google's announcement moving toward 47-day maximum validity by 20292 makes manual certificate operations economically unfeasible at enterprise scale. Organizations already struggling with 90-day renewal cycles will face permanent operational crisis at 47-day intervals.

The operational debt compounds: certificate automation depends on DNS routing for domain validation, DNS misconfigurations break certificate renewal, certificate failures generate false security alerts, false alerts train teams to ignore genuine threats.

Connection to certificate costs: The certificate coordination failures described here are part of the larger invisible infrastructure tax consuming millions annually. When certificate renewals trigger false WAF alerts, you're experiencing both the interruption cost (engineers pulled from strategic work) and the security degradation from alert fatigue.

What "Deployed Akamai WAF" Actually Means in Practice

The vendor implementation follows a standard pattern:

  1. Enable Adaptive Security Engine with managed rulesets
  2. Configure DoS protection, evaluate normal traffic patterns and continuous adjustment of rate limits
  3. Activate blocking mode for high-confidence signatures
  4. Integration complete; invoice security team

This addresses application-layer HTTP attacks. It does not address:

DNS-layer threats - Tunneling, DoS attacks against DNS servers, reconnaissance via DNS enumeration (79% of organizations face these attacks1)

Origin exposure - Direct attacks bypassing edge infrastructure entirely (found in 60% of audited deployments)

Certificate coordination - Automated renewal failures creating false security alerts that degrade SOC effectiveness

SIEM integration challenges - Akamai's authentication model requires intermediary "glue layers" for log aggregation;3 Prolexic integration described as "impossible without external tooling"4

Data volume scaling - Security telemetry from Akamai's global network "quickly exhausts bandwidth and storage limits" in standard SIEM deployments3

The technical capabilities exist. The architectural integration does not.

The Transformation Reality: Managing Existing Teams

Expanding Akamai deployment in a financial enterprise from six protected services to comprehensive perimeter coverage was done in about nine months. Not because of technical complexity - because of organizational debt. We had to synchronise

Months 1-3: Discovery of What Actually Routes Where

DNS configurations accumulated over a decade revealed contradictory routing decisions. Some services used CNAMEs to Akamai edge nodes. Others used direct A-records to origin IPs. Legacy applications had hardcoded DNS dependencies impossible to migrate without application rewrites.

Certificate inventory discovered a number of certificates with no documented ownership, no renewal procedures, no validation that certificates actually protected services still in production.

Origin server configurations assumed edge protection eliminated security requirements. Firewall rules permitted traffic from any source. Attackers with origin IP addresses faced no additional defensive layers.

Months 4-12: Enabling WAF, Building Integration Architecture

We have onboarded all but 2 internet accessible services to Akamai. Building the connecting tissue between DNS operations, certificate automation, origin hardening, and WAF intelligence.

Existing Prolexic protection logging aggregated into SIEM required custom integration because Akamai's authentication model doesn't support standard log forwarding protocols.3 Correlation between traffic volume anomalies and WAF blocks required developing detection logic the vendor doesn't provide.

Certificate automation needed coordination with the PKI team, eventually resulting in automation based on serverless AWS Lambda functions.

Origin server firewall rules migrated from "accept all traffic" to "accept only from documented Akamai edge node IP ranges" - a straightforward change that could easily break customers. We built a process with the networks teams to ensure any changes on the Akamai side would be correctly implemented on perimeter firewalls.

Months 9-12: Operational Handover and SOC Training

Technical implementation succeeds or fails based on whether security operations can actually use it. SOC analysts needed training in:

  • Distinguishing genuine WAF attacks from certificate-driven false positives
  • Correlating DNS anomalies with application-layer attacks
  • Understanding when WAF blocks indicate reconnaissance vs. actual exploit attempts
  • Escalation procedures when bypass routes are discovered

The company's security team inherited a functioning system with documented operating procedures. The transformation succeeded because we built organizational capability, not just deployed technology.

Why This Matters for Regulated Sector Contracts

Financial services clients evaluate vendors more thoroughly than commercial customers. A correct Akamai integration delivers impenetrable perimeter protecting against the largest co-ordinated attacks. At the same time, it offloads traffic from applications servers.

Procurement processes require documented evidence of operational maturity:

  • Certificate inventory with ownership and renewal procedures
  • DNS security monitoring with documented detection capabilities
  • Origin infrastructure hardening with defense-in-depth architecture
  • Incident response procedures integrating WAF, DNS, and certificate telemetry

These aren't security theatre checkboxes. They're operational requirements emerging from real-world breach analyses. When British Airways faced £183 million in GDPR fines following a 2018 breach,5 regulatory investigation highlighted inadequate security practices including certificate management failures.

Organizations competing for contracts in banking, healthcare, government, and regulated industries face procurement teams that understand operational gaps. "We deployed Akamai WAF" is table stakes. "We integrated WAF with DNS security, automated certificate coordination, and hardened origin infrastructure" differentiates competitive positioning.

The UK financial institution's transformation created documented operational maturity that have significantly improved independent consumer evaluations. Not because Akamai deployment is unique - because integrated security architecture demonstrating defense-in-depth is uncommon.

The Content Architecture

The following pages detail specific failures in enterprise Akamai deployments and remediation approaches from financial sector implementations:

The DNS Routing Hole → — How DNS misconfigurations let attackers bypass edge protection, why 79% of organizations face DNS attacks, and the five attributes that detect tunneling and DGA traffic

Why Default Rules Fail → — The Alert mode methodology that prevents false positives, attack patterns that bypass vendor-managed rulesets, and the 2-4 week tuning cycle vendors don't mention

Origin Exposure Problem → — Why 60% of deployments have discoverable origin IPs, how attackers enumerate infrastructure, and the firewall architecture that actually prevents bypass

SIEM Integration Challenges → — Akamai's authentication model requiring glue layers, data volumes exhausting standard SIEM capacity, and why Prolexic integration is "impossible without external tooling"

Certificate Coordination Failure → — How certificate expirations generate false WAF alerts, why 47-day validity creates operational crisis, and the automation architecture coordinating DNS with certificate lifecycle

12-Month Transformation Timeline → — UK bank expansion from six protected services to comprehensive perimeter coverage, organizational challenges that consume more time than technical implementation, and operational handover procedures

Related Resources

References

  1. EfficientIP. (2020). Global DNS Threat Report 2020. EfficientIP Research. https://www.efficientip.com/resources/global-dns-threat-report-2020/
  2. Chrome Root Program. (2023). Moving Forward, Together: Reducing Certificate Lifespans. Chromium Blog. https://blog.chromium.org/2023/11/reducing-tls-certificate-lifespans-to-90-days.html
  3. Akamai Technologies. (2024). Security Information and Event Management (SIEM) Integration Guide. Akamai TechDocs. https://techdocs.akamai.com/siem-integration/
  4. Akamai Community Forums. (2023). Prolexic Data Export Challenges. Akamai Developer Community. https://community.akamai.com/
  5. Information Commissioner's Office (ICO). (2019). Intention to fine British Airways £183.39m under GDPR for data breach. ICO Press Release. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2019/07/ico-announces-intention-to-fine-british-airways/
  6. Ponemon Institute & Keyfactor. (2023). 2023 State of Certificate Lifecycle Management. Ponemon Research Report. https://www.keyfactor.com/resources/ponemon-2023-clm-study/
  7. Gartner Research. (2024). Market Guide for Cloud Web Application and API Protection. Gartner ID G00793247.
  8. Akamai Technologies. (2024). State of the Internet / Security: Web Application and API Attacks. Akamai Security Intelligence Group. https://www.akamai.com/internet-station/cyber-research
  9. NIST. (2023). Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations. NIST Special Publication 800-52 Revision 2. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf
  10. OWASP Foundation. (2021). OWASP Top Ten 2021. OWASP Application Security Project. https://owasp.org/www-project-top-ten/