Announcing Zero Trust DNS Private Preview

KennethML your thinking is spot on. Imagine an Intune device receiving the client cert it needs to present to the Protective DNS server during the TLS handshake to establish the DoH connection, along with an expected cert in the server chain so the client can detect server impersonation by TLS terminating nodes. Yes, Windows requires both the DoH template (or DoT hostname) as well as the fixed IP address for security reasons (to avoid the bootstrapping DNS query from resolver name to resolver IP address). ZTDNS's primary scenario is in fact Work From Anywhere so that VPNs are unnecessary if their primary use is logging traffic destinations (after all, in a ZT world, all network paths are hostile anyway, right?)