[Iotops] Re: Encrypted DNS and draft-mishra-iotops-iot-dns-guidelines

[Jim Mozley <[e-mail]>]

On 28/07/2025, 13:42, "Tschofenig, Hannes" <[e-mail]> wrote:

You are also assuming that the combination of the source IP address and the DNS query itself reveals meaningful information to an observer. But in many cases, especially with constrained IoT devices, there is very little variability in network behavior. These devices typically connect to only a small number of servers, often just their device management server.

[JM] On the topic of devices only connecting to their device management servers I think there are a couple of points that are security related:


  *   If a device is compromised, either directly or through the supply chain, it is likely to resolve domain names not associated with device management
  *
We included some mitigation against this by proposing device manufacturers publish management domains, which they could do simply via a list or using a MUD file
  *
Network operators could use this list of valid domains to help secure devices, or look for compromise, via Protective DNS (e.g. response policy zones)

Cheers, Jim