The service is identifying itself by means of a certificate installed on the machine where your service is running.
The <dns>
tag defines what the "subject name" (or identity) of that service certificate is going to be, so that the client can check to see whether the certificate presented by the service to "prove" its identity is really what it expected it to be.
There's a really good set of blog post here that talk about WCF security scenarios - one of them (part 4) is Internet scenario which mentions the service authenticating itself by means of a certificate as well.
Hope this helps a bit
Marc