Microsoft: Announcing Zero Trust DNS Private Preview

apt_install_coffee, 1 month ago

So this is a system-wide DNS hijack for the purpose of filtering and monitoring?

So say an attacker can enable this service, would they then be able to redirect any DNS query regardless of if DNS over TLS + DNSSEC are configured? Surely I’m reading this wrong

Buelldozer, 1 month ago

So this is a system-wide DNS hijack for the purpose of filtering and monitoring?

It shifts DNS from Default Allow to Default Deny. AD DNS should have had this two decades ago.

So say an attacker can enable this service

If an attacker has already penetrated your Network Infrastructure to the point that they can setup ZTDNS you’ve already got problems so serious that DNS over TLS with DNSSEC is not going to save you.

_sideffect, 1 month ago

That’s the same amount of trust I put into Microsoft security products!