Microsoft Networking Blog: In the modern world, useful network destinations are far more likely to be defined by long-lived domain names than long-lived IP addresses. However, enforcement of...

Microsoft is working on a promising-looking protocol to lock down DNS. ZTDNS aims to solve this decades-old problem by integrating the Windows DNS engine with the Windows Filtering Platform—the core component of the Windows Firewall—directly into client devices. Jake Williams, VP of research and development at consultancy Hunter Strategy, said the union of these previously disparate engines would allow updates to be made to the Windows firewall on a per-domain name basis. The result, he said, is a mechanism that allows organizations to, in essence, tell clients “only use our DNS server, that uses TLS, and will only resolve certain domains.” Microsoft calls this DNS server or servers the “protective DNS server.” By default, the firewall will deny resolutions to all domains except those enumerated in allow lists. A separate allow list will contain IP address subnets that clients need to run authorized software. Key to making this work at scale inside an organization with rapidly changing needs. Networking security expert Royce Williams (no relation to Jake Williams) called this a “sort of a bidirectional API for the firewall layer, so you can both trigger firewall actions (by input *to* the firewall), and trigger external actions based on firewall state (output *from* the firewall). So instead of having to reinvent the firewall wheel if you are an AV vendor or whatever, you just hook into WFP.”

In the modern world, useful network destinations are far more likely to be defined by long-lived domain names than long-lived IP addresses. However,

Microsoft dévoile Zero Trust DNS, un système de sécurité DNS pour Windows. ZTDNS chiffre et authentifie le trafic entre clients et serveurs DNS, tout en permettant un contrôle des domaines autorisé…

In the modern world, useful network destinations are far more likely to be defined by long-lived domain names than long-lived IP addresses. However,

This document goes over what considerations administrators should keep in mind when evaluating how ZTDNS fits into their Zero Trust deployment model. For

<p>Microsoft is <a href="https://arstechnica.com/security/2024/05/microsoft-plans-to-lock-down-windows-dns-like-never-before-heres-how/">working on</a> a promising-looking protocol to lock down DNS.</p> <blockquote><p>ZTDNS aims to solve this decades-old problem by integrating the Windows DNS engine with the Windows Filtering Platform&#8212;the core component of the Windows Firewall&#8212;directly into client devices.</p> <p>Jake Williams, VP of research and development at consultancy Hunter Strategy, said the union of these previously disparate engines would allow updates to be made to the Windows firewall on a per-domain name basis. The result, he said, is a mechanism that allows organizations to, in essence, tell clients &#8220;only use our DNS server, that uses TLS, and will only resolve certain domains.&#8221; Microsoft calls this DNS server or servers the &#8220;protective DNS server.&#8221;...</p></blockquote>

Microsoft has announced the public preview of Zero Trust DNS (ZTDNS), a new feature in Windows 11 Insider builds designed to enhance security by enforcing domain-name-based network access controls. ZTDNS integrates the Windows DNS client with trusted Protective DNS (PDNS) servers, ensuring that outbound traffic is only permitted to IP addresses resolved by these servers.

  By adopting Zero Trust DNS (ZTDNS), organizations can strengthen their Zero Trust deployments, ensuring that Windows 11 devices only communicate with...

A follow up to the ZTDNS private preview announcement explaining some considerations for future ZTDNS deployments

ZTDNS brings the best of both worlds to DNS: encryption and fine-grained control.

ZTDNS brings the best of both worlds to DNS: encryption and fine-grained control.

This document goes over what considerations administrators should keep in mind when evaluating how ZTDNS fits into their Zero Trust deployment model. For

Microsoft dévoile Zero Trust DNS, un système de sécurité DNS pour Windows. ZTDNS chiffre et authentifie le trafic entre clients et serveurs DNS, tout en permettant un contrôle des domaines autorisé…

ZTDNS brings the best of both worlds to DNS: encryption and fine-grained control.

ZTDNS brings the best of both worlds to DNS: encryption and fine-grained control.