[DNSOP] NSA says don't use public DNS or DoH servers

John Levine <johnl@taugh.com> Mon, 18 January 2021 21:27 UTC

Date: Mon, 18 Jan 2021 16:27:20 -0500
Message-Id: <20210118212720.5E3806B53EC8@ary.qy>
From: John Levine <johnl@taugh.com>
To: dnsop@ietf.org
Organization: Taughannock Networks
Cleverness: minimal
Mime-Version: 1.0
Content-type: text/plain; charset="utf-8"
Content-transfer-encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/ztExxBBYeMAq1vpAa0rNoa6VfpQ>
Subject: [DNSOP] NSA says don't use public DNS or DoH servers
Precedence: list

They think DoH is swell, but not when it bypasses security controls
and leaks info to random outside people 

>From the summary:

  Using DoH with external resolvers can be good for home or mobile
  users and networks that do not use DNS security controls. For
  enterprise networks, however, NSA recommends using only designated
  enterprise DNS resolvers in order to properly leverage essential
  enterprise cybersecurity defenses, facilitate access to local network
  resources, and protect internal network information. 

https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2471956/nsa-recommends-how-enterprises-can-securely-adopt-encrypted-dns/

[DNSOP] NSA says don't use public DNS or DoH serv… John Levine
Re: [DNSOP] NSA says don't use public DNS or DoH … Wes Hardaker
Re: [DNSOP] NSA says don't use public DNS or DoH … Paul Vixie
Re: [DNSOP] NSA says don't use public DNS or DoH … Tom Pusateri
Re: [DNSOP] NSA says don't use public DNS or DoH … Paul Vixie
Re: [DNSOP] NSA says don't use public DNS or DoH … Vladimír Čunát
Re: [DNSOP] NSA says don't use public DNS or DoH … Stephane Bortzmeyer
Re: [DNSOP] NSA says don't use public DNS or DoH … Michael Richardson