Announcing Zero Trust DNS Private Preview

desert_lizard , ztdns is intended to be the secure telemetry system to enable connections to trusted destinations, not validate end users or apps. 

That's a separate layer of zt, (which, of course, would be locked down by its inability to do connections not listed in the approved and available DNS server.)

desert_lizard the identity of the client is verified when the encrypted DNS connection is established using mTLS -- this allows the admin to configure the client cert for Windows to present when connecting. Keep in mind that user (human-centric) identity is a huge and critical part of Zero Trust, but not the only part. Devices and data need to have verifiable integrity as well. ZTDNS provides a way to verify the machine-assigned identity from the server perspective and the server identity from the client perspective. ZTDNS aligns most closely with the "Assume Breach" aspect of Microsoft's ZT paper: https://www.microsoft.com/en-us/security/business/zero-trust 

foobar2020 your suggestion is good, but it isn't a replacement for ZTDNS anymore than ZTDNS is for your suggestion. ZTDNS allows a secured PDNS server to make segmentation-by-name policy decisions for Windows to then enforce. It does not try to do anything server-side to secure zone data.

MichaelGrafnetter I agree! ZTDNS client is not gated to Win11 SKU, so there's no reason one couldn't use it on Windows Server (though it would only affect outbound connectivity, not inbound, and there may be other gotchas we're not testing for since Win11 is our priority for now). When ZTDNS client enters Public Preview, you can try it out yourself!

I'm not sure this is zero trust.  How is the authenticity of the user being checked when doing a DNS lookup?

Foobar? How is that different than existing dnssec? 

Trusted name server, in the context of DNS , just means the zone is providing a key to prove it's authoritative to serve the records assigned to it (not spoofing a legit system) 

From the perspective of this solution, a trusted DNS resolver is already running an encrypted connection (tls or https), using the  existing certificate authority infrastructure for those services, but more importantly, the client is locked down to only use that server by DHCP/Microsoft configuration policies.

Locking down connections to only talk to systems documented in DNS goes back to the invention of TCP wrappers in the early 90s. The reason that solution wasn't practical is the lack of DNS hygiene in most networks, so I expect people will need to invest heavily on automation and management tools to run DNS properly if they expect to use this system as intended. 

A better way to address this is by locking down teh NameServers with EV cert. Similar to CA?Browser Forum - come up with a NameServer, Domain Registrar forum and have NS with EV certs. THis way if a malacious domain is registered and the Auth NS is setup -then it needs to get a EV cert which means Domain registrar or the Cert provider need to know the NS is legit.  This will reduce the Malacious DNS resolve. Or u can revoke the NS Cert. Something to explore. 

I would love to see this ZTDNS capability on Windows Server, ideally configurable through Group Policy. I would definitely use it to only enable access to Windows Update and Microsoft Defender (for Identity and Endpoint) cloud services on sensitive servers like Domain Controllers. Have not found a way to achieve this without using a 3rd-party proxy yet.

There are plenty of PDNS providers to choose from. 

This seems like a shot across the bow for next gen firewall companies... If all my clients are blocking based on threat intel they get via a trusted DNS server,  (and in this context, that server needs to be out on the internet, so your external DNS queries aren't subject to traffic analysis), DoH locally is nice, but will end up being an extra step, since you still need to send to an external service. 

Also seems like a pretty strong argument to pull DNS off your AD server completely, and put it on a platform that checks all the DNS boxes, point your AD servers and systems to do their DNS updates to your dedicated DNS systems, and move along. 

ChristianSchindler Today, DoH and DoT are not supported by the Windows DNS server which means ZTDNS during preview relies on third-party DNS servers. However, I know the owners of the Windows DNS server and they've said that they plan to support DoH in a future version of Windows Server.

To your other point, yes, and calling it a hassle is putting it lightly. It is expected that getting ZTDNS fully deployed in enforcement mode will be a long-term journey that starts with testing it out in audit mode (logging, but no enforcement) to discover the real-world name dependencies your network has, and slowly building up allowlists and attempting to reduce the unknown lists (not explicitly allowed but not blocked either). It isn't a feature for everyone, but for enterprises with high compliance expectations, it will be a unique tool in their Zero Trust toolkit that will be worth the ROI.