nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community Discussions

The most recent content from our members.

Community Discussions

The most recent content from our members.

DoH and DoT on Infoblox NIOS DNS

dotax

Hi all,

I am kind of fresh towards the implementation of DoH and DoT in infoblox, not sure if i am asking the question the correct way.

Currently my customer environment is using Infoblox NIOS as their internal recursive DNS server + authoritative DNS zones (example localdomain.com) . They have just been asking to enable DoT and DoH on Infoblox, but i have doubt on this.

As far based on my searching, Infoblox uses ADP license to sort of "block" DoT and DoH DNS signature only, am i right?

Customer expectation is to allow internal users able to use DoT and DoH for external FQDN and Internal FQDN (localdomain.com) DNS resolution from internal users. I somehow not quite sure if Infoblox support this kind of setup.

With the implementation of both protocol, DNS traffic is no longer visible in UDP 53 packets, so i wonder how infoblox Auth and Recursive DNS still able to works for localdomain resolution?

Thanks for your feedback in advanced!

Find more posts tagged with

DNS

NIOS

Comments

dgoldstein

The best approach is to discuss changes with the Infoblox account team for that customer since there may be other caveats where your proposed implementation could become problematic.

DoT/DoH require the DCA or ADP service (now DNS Infrastructure Protection) to be licensed and enabled. If that service is not running, DoT/DoH will not work. The servers should be sized to handle the additional load.

DoT/DoH terminates on the NIOS member, then NIOS handles DNS normally behind the scenes. The encryption only changes the client-to-NIOS transport; it does not change how NIOS resolves authoritative data or recursion. So yes, internal users can use DoT/DoH to resolve external FQDNs and internal zones.

Some filtering rules may need to be written for the underlying UDP recursion path, because TCP rules over HTTPS may not be honored for queries that are decrypted and then forwarded to recursion.

DoH appears as any other traffic over port 443, which might hamper the support team’s ability to maintain the levels of network performance, security, scale, and reliability that enterprises demand from DNS.

See the DoT/DoH Deployment Guide for best practices and security risk mitigations:
https://docs.infoblox.com/space/DeploymentGuideDoTDoH/695599261/Introduction

dotax

Hi,

I wondering, as an example in simple DNS flow

DNS Client —→ Infoblox ——> ISP DNS —→ Google DNS (DoT/DoH)

If the DNS client initiated DNS recursive through DoH traffic to Infoblox NIOS members, the Infoblox NIOS members will handles DNS normally with upstream ISP DNS through DoH or normal UDP 53 protocol?

I also wondering if there is any configuration in Infoblox, that we can set if to forward DNS packets between UDP 53 and DoH or DoT to different public resolvers?

dgoldstein

Excellent questions.

DoH forwarding is not supported or recommended.

NIOS DFP (DNS Forward Proxy) can terminate DoT/DoH and plain DNS, and forward those requests as DoT to Infoblox Threat Defense.

Threat Defense can be configured to forward to external public DoT servers exclusively, or optionally fall back to plain DNS.