Microsoft introduces Zero Trust DNS Private Preview (ZTDNS) to block encrypted traffic from apps and malware

In a move aimed at boosting the security infrastructure, Microsoft is bringing Zero Trust DNS (ZTDNS) to Windows devices. Currently in the Private Preview, ZTDNS will soon be available to Windows Insiders.

In the official announcement, Microsoft explains how ZTDNS, integrated with the Windows DNS (Domain Name System) client and the Windows Filtering Platform (WFP), works.

First, Windows is provisioned with a set of DoH or DoT capable Protective DNS servers; these are expected to only resolve allowed domain names. This provisioning may also contain a list of IP address subnets that should always be allowed (for endpoints without domain names), expected Protective DNS server certificate identities to properly validate the connection is to the expected server, or certificates to be used for client authentication.

Elaborating on the next step in the authentication process, Microsoft explains,

In simple words, any network traffic (IPv4 and IPv6) to an IP address not a part of ZTDNS will be blocked. With this, administrators can quickly and securely block traffic whose associated domain names are not identified.

In another blog post highlighting deployment considerations for Windows’ Zero Trust DNS, Microsoft highlights that the feature might conflict with printing, file sharing, Windows updates, teleconferencing apps, media streaming, and casting to wireless displays. However, all these can be resolved through some quick modifications!

Microsoft also explains that ZTDNS might not be as effective when deployed alongside VPNs, SASE/SSE tunnels, and Hyper-V VMs. Besides, anyone with administrative privileges on the PC can disable Microsoft’s Zero Trust DNS via the built-in settings. So, admins should reconsider the permissions they grant to users!

There will be several improvements in Zero Trust DNS before it’s finally introduced in the stable version of Windows, as confirmed by Microsoft.

If you are aiming for speed, learn how to find the fastest DNS server near you!

What is your first impression of Microsoft’s Zero Trust DNS? Share with our readers in the comments section.