Encrypted DNS and a final zone review

Traditional DNS queries are often visible on the network. DNS over TLS and DNS over HTTPS encrypt the connection between a client and a supporting resolver.

DNS over TLS, or DoT, carries DNS through TLS on a dedicated service. DNS over HTTPS, or DoH, carries DNS queries inside HTTPS. Both can prevent a local network observer from reading or modifying that client-to-resolver exchange.

Encryption changes who can observe the query; it does not eliminate trust. The selected resolver can still see the requested names, apply filtering, log metadata, and perform the remaining authoritative lookups. Those upstream lookups are not automatically encrypted just because the first hop used DoH or DoT.

DNSSEC solves a different problem:

• DoH and DoT protect transport between two endpoints.
• DNSSEC lets a validating resolver authenticate signed DNS data.

Encrypted transport without validation can carry an incorrect answer securely. DNSSEC without encrypted transport can authenticate an answer while leaving the query visible. A deployment can use both.

Encrypted DNS can also affect operations. A browser using its own DoH resolver may bypass the operating system resolver, company split-horizon names, or local filtering. During diagnosis, identify the actual resolver instead of assuming every application uses the network default.

For the final review, choose a domain you control or can inspect safely. Record its delegated nameservers, SOA, A and AAAA answers, aliases, MX and TXT records, TTLs, DNSSEC state, and web response.

Build the review from evidence:

dig +trace example.com
dig SOA example.com
dig A example.com
dig AAAA example.com
dig MX example.com
dig TXT example.com
dig +dnssec A example.com
curl -I https://example.com/

For every answer, name its owner, type, value, TTL, authoritative provider, and consuming service. Separate observations from conclusions: an A answer proves address data exists, not that HTTPS works; an SPF record proves policy is published, not that every legitimate sender passes DMARC.

Finish by proposing one safe change. Include the old and new values, the current TTL, when to lower it, how to test the new service before cutover, direct-authority verification, resolver comparisons, rollback trigger, and the time the old service can be retired.

Your action is to produce that one-page zone review. End with the three most important risks you found and the exact evidence that would prove each risk has been removed.