Microsoft plans to lock down Windows DNS like never before. Here’s how.

Wolfzz · May 4, 2024

Microsoft plans to lock down Windows DNS like never before. Here’s how.

ZTDNS brings the best of both worlds to DNS: encryption and fine-grained control.

arstechnica.com

Ghot · May 4, 2024

Great. MS screws up the BIOS, then Windows, now they're going for the hat trick by screwing up the internet too.

antspants · May 4, 2024

Ghot said:
by screwing up the internet too

How so? Reads to me like an improvement?

Ghot · May 4, 2024

antspants said:
How so? Reads to me like an improvement?

Any time there's a allowed list for anything... MS has the chance to censor things.
On the surface, these things "sound" OK, but in practice... they just screw things up.

It's gonna be like a hammer company, telling you what things you can hit with your hammer.
Or a publisher telling you what you can and can't read, including things that other companies publish.

pseymour · May 4, 2024

Ghot said:
Any time there's a allowed list for anything... MS has the chance to censor things.
On the surface, these things "sound" OK, but in practice... they just screw things up.

It's gonna be like a hammer company, telling you what things you can hit with your hammer.
Or a publisher telling you what you can and can't read, including things that other companies publish.

Except it's not Microsoft administering the DNS servers. It's admins on the corporate network.

Ghot · May 4, 2024

pseymour said:
Except it's not Microsoft administering the DNS servers. It's admins on the corporate network.

And ISPs.

In house, in a corporation... fine, as long as the corporation is only controlling it's, computers and internet connections.
But MS wants to build a DNS block list into... Windows. A block list that MS has control over.

The internet and even cellular networks... aren't safe. That's a fact of life.
YOU have to be safe when using them... that's your protection.

MS saying they can make things safe... is BS.
Unless they control everything you or your computer does... there's no way to do that.

I can make any car 100% safe. I just take away the keys.

pseymour · May 5, 2024

Where are you getting that Microsoft has control over a block list?

And your ISP already controls your traffic, so that ship sailed a long time ago.

Ghot · May 5, 2024

pseymour said:
Where are you getting that Microsoft has control over a block list?

And your ISP already controls your traffic, so that ship sailed a long time ago.

1. Maybe not on Windows XX Enterprise.

2. Congress seems to have more control over ISPs than they do over Microsoft.

Deployment Considerations for Windows ZTDNS Client

A follow up to the ZTDNS private preview announcement explaining some considerations for future ZTDNS deployments

techcommunity.microsoft.com

pseymour · May 5, 2024

Even if Microsoft had a bunch of public DNS servers under their control, no one has to use them, home or enterprise or whatever. Plenty of other DNS options exist outside your ISP or an alleged conspiracy theory MSFT DNS.

And again, that’s not what the zero trust DNS in the article is. It’s for enterprises running Windows DNS.

Actually, while I’m sure some people still do, I don’t personally know any enterprises using Windows DNS servers. Again, they probably exist, somewhere, but I haven’t seen one in forever.

You’re just saying a bunch of things with no backup or evidence. Maybe you’re trolling. I should probably assume so.

ian50 · May 5, 2024

@pseymour

For me, reading the article linked in the OP, this sentence rings possible alarm bells:

By default, the firewall will deny resolutions to all domains except those enumerated in allow lists

Assumption here is that the "firewall" is inbuilt into the Windows OS. If so, who then proscribes these "allow" lists ?

TairikuOkami · May 5, 2024

Maybe MS should start by forcing it's own services to run encrypted DNS first and not ignore it, like Edge does?

I tried every options I could find to disable the insecure DNS, yet 11 will not budge. I can only block it in the firewall.

Code:

rem 1 - DNS interception checks enabled
reg add "HKLM\Software\Policies\Microsoft\Edge" /v "DNSInterceptionChecksEnabled" /t REG_DWORD /d "0" /f

rem 1 - DNS-based WPAD optimization (Web Proxy Auto-Discovery)
reg add "HKLM\Software\Policies\Microsoft\Edge" /v "WPADQuickCheckEnabled" /t REG_DWORD /d "0" /f

rem Disable Discovery of Designated Resolvers (DDR), a mechanism for DNS clients to use DNS records to discover a resolver's encrypted DNS configuration
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "EnableDdr" /t REG_DWORD /d "0" /f

rem 3 - Require DoH / 2 - Allow DoH / 1 - Prohibit DoH
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "DoHPolicy" /t REG_DWORD /d "3" /f

rem Disable IDN (internationalized domain name)
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "DisableIdnEncoding" /t REG_DWORD /d "1" /f
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "EnableIdnMapping" /t REG_DWORD /d "0" /f

rem 1 - Discovery of Network-designated Resolvers DNS over TLS (DoT), DNS over HTTPS (DoH), DNS over QUIC (DoQ)
reg add "HKLM\System\CurrentControlSet\Services\Dnscache\Parameters" /v "EnableDnr" /t REG_DWORD /d "0" /f

rem Disable smart multi-homed name resolution
rem https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197552(v=ws.10)
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "DisableSmartNameResolution" /t REG_DWORD /d "1" /f
reg add "HKLM\System\CurrentControlSet\Services\Dnscache\Parameters" /v "DisableParallelAandAAAA" /t REG_DWORD /d "1" /f

rem Disable Multicast/mDNS repeater / https://f20.be/blog/mdns
reg add "HKLM\System\CurrentControlSet\Services\Dnscache\Parameters" /v "EnableMDNS" /t REG_DWORD /d "0" /f
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "EnableMulticast" /t REG_DWORD /d "0" /f

rem Setup DNS over HTTPS (DoH)
reg add "HKLM\System\CurrentControlSet\Services\Dnscache\Parameters" /v "EnableAutoDoh" /t REG_DWORD /d "2" /f

rem 1 - Disable Domain Name Devolution (DNS AutoCorrect) / 0 - Enabled (Default)
reg add "HKLM\System\CurrentControlSet\Services\Tcpip\Parameters" /v "UseDomainNameDevolution" /t REG_DWORD /d "0" /f

antspants · May 5, 2024

ian50 said:
@pseymour

For me, reading the article linked in the OP, this sentence rings possible alarm bells:

By default, the firewall will deny resolutions to all domains except those enumerated in allow lists

Assumption here is that the "firewall" is inbuilt into the Windows OS. If so, who then proscribes these "allow" lists ?

pseymour said:
Except it's not Microsoft administering the DNS servers. It's admins on the corporate network.

ian50 · May 5, 2024

"Admins on the corporate network" is ok by me.

As long as Deep State bureaucrats stay out out of it (that includes the Aus, UK, EU ones as well) and don't start requesting built-in blockages ...

PerpetualCycle · May 5, 2024

This is meant for organizations, not you or I. We can already fully encrypt our DNS transactions with ECH (encrypted client hello) on windows 11 with the correct network settings. The problem with this is that organizations use the information contained in a DNS query to control which sites and domains their clients can access. They can no longer do this because that information is fully encrypted. This has been a thorny issue for adoption of ECH in DNS servers. Google and Cloudfare provide free DNS servers that support ECH. This is good for privacy so noone can find out the sites you are visiting.

It is not Microsoft messing up the internet. They are supplying their corporate and government clients with a solution so that they can use fully encrypted DNS while still controlling what sites and domains their organization can access.

PerpetualCycle · May 5, 2024

TairikuOkami said:

Maybe MS should start by forcing it's own services to run encrypted DNS first and not ignore it, like Edge does?

View attachment 95387 View attachment 95388

I tried every options I could find to disable the insecure DNS, yet 11 will not budge. I can only block it in the firewall.

Code:

rem 1 - DNS interception checks enabled
reg add "HKLM\Software\Policies\Microsoft\Edge" /v "DNSInterceptionChecksEnabled" /t REG_DWORD /d "0" /f

rem 1 - DNS-based WPAD optimization (Web Proxy Auto-Discovery)
reg add "HKLM\Software\Policies\Microsoft\Edge" /v "WPADQuickCheckEnabled" /t REG_DWORD /d "0" /f

rem Disable Discovery of Designated Resolvers (DDR), a mechanism for DNS clients to use DNS records to discover a resolver's encrypted DNS configuration
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "EnableDdr" /t REG_DWORD /d "0" /f

rem 3 - Require DoH / 2 - Allow DoH / 1 - Prohibit DoH
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "DoHPolicy" /t REG_DWORD /d "3" /f

rem Disable IDN (internationalized domain name)
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "DisableIdnEncoding" /t REG_DWORD /d "1" /f
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "EnableIdnMapping" /t REG_DWORD /d "0" /f

rem 1 - Discovery of Network-designated Resolvers DNS over TLS (DoT), DNS over HTTPS (DoH), DNS over QUIC (DoQ)
reg add "HKLM\System\CurrentControlSet\Services\Dnscache\Parameters" /v "EnableDnr" /t REG_DWORD /d "0" /f

rem Disable smart multi-homed name resolution
rem https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197552(v=ws.10)
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "DisableSmartNameResolution" /t REG_DWORD /d "1" /f
reg add "HKLM\System\CurrentControlSet\Services\Dnscache\Parameters" /v "DisableParallelAandAAAA" /t REG_DWORD /d "1" /f

rem Disable Multicast/mDNS repeater / https://f20.be/blog/mdns
reg add "HKLM\System\CurrentControlSet\Services\Dnscache\Parameters" /v "EnableMDNS" /t REG_DWORD /d "0" /f
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "EnableMulticast" /t REG_DWORD /d "0" /f

rem Setup DNS over HTTPS (DoH)
reg add "HKLM\System\CurrentControlSet\Services\Dnscache\Parameters" /v "EnableAutoDoh" /t REG_DWORD /d "2" /f

rem 1 - Disable Domain Name Devolution (DNS AutoCorrect) / 0 - Enabled (Default)
reg add "HKLM\System\CurrentControlSet\Services\Tcpip\Parameters" /v "UseDomainNameDevolution" /t REG_DWORD /d "0" /f

They already do. In settings, network. Your network. And setup DNS manually, use DNS server 1.1.1.1 with 1.0.0.1 as secondary. These are cloudflare DNS servers that support ECH. You will then be provided with options to encrypt or not.

If you still cannot post back here and I will walk you through it.

Brink · May 5, 2024

Microsoft Announcing Zero Trust DNS (ZTDNS) Private Preview for Windows 11

Microsoft Networking Blog: In the modern world, useful network destinations are far more likely to be defined by long-lived domain names than long-lived IP addresses. However, enforcement of domain name boundaries (such as blocking traffic associated with a forbidden domain name) has always been...

www.elevenforum.com

pseymour · May 5, 2024

ian50 said:
@pseymour

For me, reading the article linked in the OP, this sentence rings possible alarm bells:

By default, the firewall will deny resolutions to all domains except those enumerated in allow lists

Assumption here is that the "firewall" is inbuilt into the Windows OS. If so, who then proscribes these "allow" lists ?

From the same article: “This will allow administrators to define domain-name-based lockdown using policy-aware Protective DNS servers.”

andrew129260 · May 8, 2024

antspants said:
How so? Reads to me like an improvement?

Because it is. It is a good improvement to security. The fear mongering of evil microsoft in here sometimes is a little insane to me.

pseymour said:
Except it's not Microsoft administering the DNS servers. It's admins on the corporate network.

Exactly

pseymour said:
And your ISP already controls your traffic, so that ship sailed a long time ago.

Exactly. You can use an alternate dns as well as an additional vpn to hide your traffic somewhat depending on the vpn provider. But regardless of what you do, you will and can be tracked. If not by your devices, you will be tracked by others around you. If your worried about all this stuff it is a little late for that.

pparks1 · May 8, 2024

Ghot said:
And ISPs.

In house, in a corporation... fine, as long as the corporation is only controlling it's, computers and internet connections.
But MS wants to build a DNS block list into... Windows. A block list that MS has control over.

The internet and even cellular networks... aren't safe. That's a fact of life.
YOU have to be safe when using them... that's your protection.

MS saying they can make things safe... is BS.
Unless they control everything you or your computer does... there's no way to do that.

I can make any car 100% safe. I just take away the keys.

They aren't talking about home users, enthusiasts, etc.

Windows will be able to support and utilize the technology for organizations/companies where this type of control is expected/needed/desired.

pparks1 · May 8, 2024

ian50 said:
@pseymour

For me, reading the article linked in the OP, this sentence rings possible alarm bells:

By default, the firewall will deny resolutions to all domains except those enumerated in allow lists

Assumption here is that the "firewall" is inbuilt into the Windows OS. If so, who then proscribes these "allow" lists ?

Remember, Microsoft have multiple customer bases.

Home Users/enthusiasts use Windows and manage a lot of their own stuff.

Corporate organization use Windows and need to be able to lock down and control their systems to protect their assets.

Both sets of users have a "firewall" built into Windows that can be used. There isn't a concept of the home firewall and the corporate firewall built into Windows. Thus, corporations who setup and control what is included in the allowed lists have finer more granular control of their corporate windows devices. It's not Microsoft setting this up for people across their entire user base.

Corporate IT world is a lot different from enthusiast world.