As DNS traffic has become an increasingly attractive target for both surveillance and exploitation, the security community has developed encrypted DNS protocols designed to protect the confidentiality and integrity of DNS queries. However, these same protocols introduce new challenges for enterprise security teams that rely on DNS visibility for threat detection and policy enforcement.

The core tension: Standard DNS queries are transmitted in plaintext over UDP port 53 — visible to anyone on the network path. Encrypted DNS fixes this privacy problem, but can bypass your security controls entirely if not managed properly.

Encrypted DNS Protocols

Three primary protocols have emerged to address the vulnerability of plaintext DNS:

Protocol Comparison
DNS over HTTPS (DoH) — encapsulates DNS within HTTPS on port 443; indistinguishable from normal web traffic; supported natively by Chrome, Firefox, and Edge
DNS over TLS (DoT) — encrypts DNS using TLS on dedicated port 853; identifiable as DNS traffic, making it easier for network admins to manage
DNSCrypt — older protocol that authenticates and encrypts DNS traffic; less widely adopted but still in use over TCP/UDP port 443

The Enterprise Security Challenge

While encrypted DNS protocols protect user privacy from external observers, they create a significant challenge for enterprise security operations. When endpoints use DoH to send DNS queries directly to external resolvers like Cloudflare (1.1.1.1) or Google (8.8.8.8), the organization's internal DNS infrastructure is bypassed entirely.

What breaks: DNS-based threat detection fails. Content filtering is bypassed. Data exfiltration via DNS tunneling goes undetected. Incident response loses a critical log source. Malware families are already using DoH for C2 communication, knowing it blends with legitimate HTTPS traffic.

Establishing DNS Control Points

The solution is not to abandon encrypted DNS — the privacy and integrity benefits are real — but to establish controlled DNS resolution within the enterprise network:

Step 1
Deploy internal encrypted resolvers — provide DoH/DoT resolution internally so endpoints benefit from encryption without bypassing organizational controls
Step 2
Block unauthorized DNS egress — firewall rules to prevent direct DNS queries (port 53, 853, and DoH to known external resolvers) from leaving the network
Step 3
Monitor for protocol abuse — detection rules for DNS tunneling indicators, anomalous query volumes, and connections to known DoH endpoints
Step 4
Enforce browser DNS policies — use group policy or MDM to configure browser DoH settings to use internal resolvers rather than public defaults

Shield53's Approach

Shield53's DNS Virtual Appliance addresses the encrypted DNS challenge by serving as the organization's authoritative DNS resolver with full support for DoH and DoT. All DNS queries — whether encrypted or plaintext — are resolved through a controlled inspection point where threat intelligence, content filtering, and logging are applied consistently.

This ensures that the security benefits of DNS visibility are maintained even as encrypted DNS adoption accelerates — protecting both user privacy and organizational security simultaneously.

Contact Shield53 to learn how to implement secure DNS controls for your environment.