DNS Security: DNSSEC, DoH, and DoT

Secure DNS to prevent hijacking and surveillance.

DNS is a critical but often overlooked attack surface.

DNS Threats

- DNS spoofing/cache poisoning
- DNS tunneling (data exfiltration)
- DNS hijacking
- Surveillance of queries

- DNSSEC: Authenticates responses
- DoH: DNS over HTTPS
- DoT: DNS over TLS
- DNS filtering services

- Enable DNSSEC validation
- Use encrypted DNS (1.1.1.1, 8.8.8.8)
- Deploy DNS filtering
- Monitor DNS logs
- Block DNS tunneling