The National Security Agency (NSA) on Wednesday published guidance for businesses on the adoption of an encrypted domain name system (DNS) protocol, specifically DNS over HTTPS.
Designed to translate the domain names included in URLs into IP addresses, for an easier navigation of the Internet, DNS has become a popular attack vector, mainly because requests and responses are transmitted in plaintext.
DNS over HTTPS, or DoH, aims to address this shortcoming by sending DNS requests over HTTPS, encrypted, and thus protecting traffic between a client and a DNS resolver. DoH improves privacy and integrity, preventing eavesdropping and DNS traffic manipulation, and is enjoying increasing adoption among enterprises.
To ensure they can continue to govern DNS usage within their networks, enterprises need to allow only for a specific DoH resolver to be used. The use of DNS controls within enterprise environments can prevent techniques that threat actors use for initial access, data exfiltration, or command and control.
“Using DoH with external resolvers can be good for home or mobile users and networks that do not use DNS security controls. For enterprise networks, however, NSA recommends using only designated enterprise DNS resolvers in order to properly leverage essential enterprise cybersecurity defenses, facilitate access to local network resources, and protect internal network information,” the NSA notes.
Enterprises can use either own-operated DNS servers or external services, but support for encrypted DNS requests such as DoH is crucial for ensuring local privacy and integrity protections, NSA notes. The agency also recommends disabling other encrypted DNS resolvers and ensuring that all DNS traffic, either encrypted or not, is sent to the designated enterprise DNS resolver only.
“However, if the enterprise DNS resolver does not support DoH, the enterprise DNS resolver should still be used and all encrypted DNS should be disabled and blocked until encrypted DNS capabilities can be fully integrated into the enterprise DNS infrastructure,” the agency explains.
The newly published NSA guidance not only provides information on how DNS and DoH work, but also details the purpose behind the DoH design, as well as why enterprise networks should be appropriately configured to add benefits to DNS security controls.
By applying the provided recommendations, the NSA says, enterprise network owners and admins can balance privacy and governance when it comes to DNS.
Related: CISA Reminds Federal Agencies to Use Its DNS Service
Related: Firefox Gets DNS-over-HTTPS as Default in U.S.
Related: Identifying DNS-Over-HTTPS Traffic Without Decryption Possible: Researcher
