{"id":11774,"date":"2025-06-09T08:55:29","date_gmt":"2025-06-09T15:55:29","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=11774"},"modified":"2025-06-05T13:57:03","modified_gmt":"2025-06-05T20:57:03","slug":"encrypted-dns-protective-dns","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/security\/encrypted-dns-protective-dns\/","title":{"rendered":"Encrypted DNS + Protective DNS = ?"},"content":{"rendered":"

If you\u2019re as old as I am, you may remember this now-classic commercial<\/strong><\/a> for Reese\u2019s Peanut Butter Cups. The gist of the ad was that chocolate and peanut butter are \u201ctwo great tastes that taste great together.\u201d (The ad may cause you youngsters to wonder, \u201cDid people in the 80s really walk around with open jars of peanut butter?\u201d Why yes, yes we did. Much as you kids walk around with those giant Stanley water bottles nowadays.) <\/p>\n

Fast-forward on your Walkman 40-odd years and the new chocolate and peanut butter are Encrypted DNS and Protective DNS. Metaphorically, anyway. And maybe only for those of us in the DNS community\u2014you know, the cool kids. <\/p>\n

As you probably know, Encrypted DNS<\/a><\/strong> addresses that pesky \u201clast-mile\u201d problem that DNS has: the vulnerability of communications between DNS stub resolvers and recursive DNS servers to snooping and spoofing. Now we can encrypt that traffic using one of several mechanisms, shielding it from prying eyes and preventing unauthorized bit twiddling. We can even authenticate the stub resolver and DNS server at either end of the line. <\/p>\n

Protective DNS enhances good ol\u2019 DNS resolution to allow administrators to apply policy, preventing the resolution of domain names we know are malicious or suspicious. Because DNS is used to mediate nearly every transaction over the internet, and because nearly every type of device connected to the internet uses DNS, this provides a universal layer of protection. <\/p>\n

These two enhancements to traditional DNS are significant enough that they\u2019ve both been added to the latest draft<\/a><\/strong> of the National Institute of Standards and Technology\u2019s venerable Special Publication 800-81, the Secure Domain Name System (DNS) Deployment Guide<\/em>. <\/p>\n

But the real Reese\u2019s goodness shows when these two mechanisms are combined. That\u2019s what Microsoft has done with Zero Trust DNS (ZTDNS): integrated Encrypted DNS and Protective DNS to create a powerful Zero Trust security solution. <\/p>\n

In a ZTDNS environment, a Windows DNS client is configured to query one or more Protective DNS servers using an Encrypted DNS protocol such as DoT or DoH. The Windows DNS client ensures that the computer can only query those authorized DNS servers. And the Windows TCP\/IP stack ensures that the computer can only send traffic to IP addresses that have been resolved by the Protective DNS servers\u2014in effect, destinations that have been vetted by Protective DNS. <\/p>\n

With the appropriate policies configured on the Protective DNS servers (possibly via Response Policy Zone feeds), this system can protect users from inadvertently visiting phishing sites or clicking lookalike domain names. It can prevent malware from rendezvousing with command-and-control infrastructure or reconnoitering the local network. <\/p>\n

If you\u2019re interested, my colleague Krupa wrote a more technical (albeit less chocolatey) overview of Protective DNS and ZTDNS here<\/a><\/strong>. And if you\u2019d like to try ZTDNS out, it\u2019s now in a public preview<\/a><\/strong>. I think it\u2019s one of the coolest things since \u2026 well, you know. <\/p>\n