Announcing Zero Trust DNS Private Preview
techcommunity.microsoft.com
Enabling domain-name-based lockdown of Windows for Zero Trust deployments in future versions of Windows
  • @[email protected]English
    3•14 days ago

    So this is a system-wide DNS hijack for the purpose of filtering and monitoring?

    So say an attacker can enable this service, would they then be able to redirect any DNS query regardless of if DNS over TLS + DNSSEC are configured? Surely I’m reading this wrong

    • BuelldozerEnglish
      6•14 days ago

      So this is a system-wide DNS hijack for the purpose of filtering and monitoring?

      It shifts DNS from Default Allow to Default Deny. AD DNS should have had this two decades ago.

      So say an attacker can enable this service

      If an attacker has already penetrated your Network Infrastructure to the point that they can setup ZTDNS you’ve already got problems so serious that DNS over TLS with DNSSEC is not going to save you.