David Bombal #560: The one BIG mistake you are making with DNS security today
Mar 18, 2026
Cricket Liu, longtime DNS expert and author of DNS and BIND, explains why DNS remains the internet’s weakest link. He contrasts encrypted DNS with protective DNS, outlines RPZ defenses, clarifies DNSSEC’s role as validation not encryption, and warns how encrypted DNS can be abused for exfiltration. He also highlights NIST SP 800-81 updates and practical hardening steps for real-world networks.
AI Snips
Chapters
Books
Transcript
Episode notes
Use RPZ To Block Malicious Domains
- Do deploy Protective DNS (PDNS) using Response Policy Zones to block known-malicious domains at the DNS layer.
- RPZ lets you subscribe to threat feeds and return NXDOMAIN or a blocking IP to stop C2, phishing, and DNS tunneling.
Subscribe To RPZ Feeds For Timely Protection
- Do subscribe to RPZ threat feeds from trusted providers and configure your DNS servers as secondaries to automatically receive updates.
- RPZ uses DNS zone transfer/notify so even very large feeds can be distributed incrementally to maintain timeliness.
Encrypted DNS Creates Visibility Tradeoffs
- Encrypted DNS can reduce enterprise visibility and break internal monitoring tools if clients bypass internal resolvers.
- Allowing client DoH/DoT to external resolvers hides queries from IDS/IPS and hampers troubleshooting.
