--- title: "Articles on Zero Trust Connectivity | ADAMnetworks" description: "ADAMnetworks articles on DNS, encrypted DNS, network defense, and how Zero Trust Connectivity makes default-deny practical for any device." url: https://adamnet.works/blog/articles/ index: https://adamnet.works/llms.txt --- Perspectives # Articles Technical perspectives on DNS, Zero Trust Connectivity, and modern network defense. [All posts](https://adamnet.works/blog.md) [Security Research](https://adamnet.works/blog/security-research.md) [Articles](https://adamnet.works/blog/articles.md) [Announcements](https://adamnet.works/blog/announcements.md) 1–12 of 24 [RSS](https://adamnet.works/blog/articles/rss.xml) ## [Faster Than Real-Time? Why Your Security Fails and What to Do Next](https://adamnet.works/blog/faster-than-real-time.md) November 10, 2025 · Francois Driessen | ADAMnetworks At GITEX 2025, Spire Connect’s Pankaj Sharma asked Francois Driessen what to do when security systems fail. Why even real-time detection is too slow, and how Zero Trust Connectivity denies connections first. Zero Trust Connectivity · Interview · +1 Read more ## [Preventing DNS Filtering Bypass by Encrypted DNS (DoT, DoH, DoQ)](https://adamnet.works/blog/preventing-encrypted-dns-filtering-bypass.md) October 31, 2025 · David Redekop | ADAMnetworks Encrypted DNS hides queries from protective DNS policy. A lab walk-through of Do53, direct-to-IP and allowed DoH URL bypass attempts, and how a local Zero Trust Resolver keeps encryption and enforcement together. Encrypted DNS · DoH · +1 Read more ## [DTTS | Zero Trust DNS Enforcement: Policy Violation Management](https://adamnet.works/blog/dtts-policy-violation-management.md) October 23, 2025 · David Redekop | ADAMnetworks In a default-deny network, legacy apps, VoIP and peer-to-peer tools and time-bound connections can fail DTTS checks. The three categories of violation, how traffic logs show them, and how Enablers grant exceptions. DTTS · Zero Trust DNS · +1 Read more ## [Purdue 2.0? Rising to the Challenge to Secure OT with Zero Trust Connectivity](https://adamnet.works/blog/purdue-2-0-securing-ot-with-zero-trust-connectivity.md) October 8, 2025 · Francois Driessen | ADAMnetworks OT environments face organized crime, nation-state attacks and IT/OT convergence that the Purdue Model and IEC 62443 alone cannot stop. How Zero Trust Connectivity controls egress at every level, with four test cases. OT Security · Purdue Model · +1 Read more ## [DNS TXT Records: The Swiss Army Knife of Domain Data](https://adamnet.works/blog/dns-txt-records.md) August 15, 2025 · David Redekop | ADAMnetworks DNS TXT records carry SPF, DKIM and verification data, and now malware and C2 traffic too. Passive DNS analysis of who needs TXT answers, and how adam:ONE blocks them for risky endpoints while allowing the rest. DNS TXT · Malware · +1 Read more ## [Endpoint Adoption of Encrypted DNS](https://adamnet.works/blog/endpoint-adoption-of-encrypted-dns.md) June 19, 2025 · David Redekop | ADAMnetworks A hands-on test of how far Windows, Android and iOS have adopted encrypted DNS through DDR and DNR, with the adam:ONE lab setup, the queries each platform sends, and what administrators can enable today. Encrypted DNS · DDR · +1 Read more ## [DNS Rebind Protection Revisited](https://adamnet.works/blog/dns-rebind-protection-revisited.md) June 13, 2025 · David Redekop | ADAMnetworks Yandex and Meta used localhost to track Android users across web and apps. How DNS rebind protection in adam:ONE blocked the Yandex technique by default for years, and how to exempt legitimate private-IP answers. DNS Rebinding · Privacy · +1 Read more ## [Unmasking ECH: Why DNS-at-the-Root-of-Trust Holds the Key to Secure Connectivity](https://adamnet.works/blog/unmasking-ech-dns-root-of-trust.md) May 29, 2025 · David Redekop | ADAMnetworks Encrypted Client Hello hides the SNI that security tools have used to identify destinations. Why protective DNS only partly fills the gap, and how DNS at the root of trust with DTTS restores control. ECH · Encrypted DNS · +1 Read more ## [Hairpin NAT vs Split-DNS](https://adamnet.works/blog/hairpin-nat-vs-split-dns.md) March 19, 2025 · David Redekop | ADAMnetworks How hairpin NAT and split-DNS each let internal devices reach a port-forwarded service by its public name, why split-DNS is the safer and faster choice, and how to set it up with an adam:ONE authoritative rule. Split-DNS · NAT · +1 Read more ## [About Microsegmentation](https://adamnet.works/blog/microsegmentation.md) March 15, 2025 · David Redekop | ADAMnetworks From early network segmentation to VLANs, agent-based micro-segmentation and port isolation: why each still leaves lateral movement open without egress control, and how Zero Trust Connectivity closes it. Microsegmentation · Lateral Movement · +1 Read more ## [DNS Server Pinning at the Network Level](https://adamnet.works/blog/dns-server-pinning.md) February 3, 2025 · David Redekop | ADAMnetworks DNS server pinning mandates one protective DNS server for every client on a network, whatever its static setting. Why to do it, the cases where it breaks DNS, and the gateway rules for AsusWRT, pfSense and VyOS. DNS · Network Security · +1 Read more ## [Infrastructure Laundering: How DNS as the Root of Trust Offers Protection](https://adamnet.works/blog/infrastructure-laundering-dns-root-of-trust.md) January 30, 2025 · David Redekop | ADAMnetworks Scam operations hide behind the same cloud infrastructure as legitimate sites. Using a live pig butchering domain on Cloudflare, how Zero Trust Connectivity with DNS as the root of trust blocks it anyway. Infrastructure Laundering · Scams · +1 Read more Page 1 [Page 2](https://adamnet.works/blog/articles/2.md) [Older](https://adamnet.works/blog/articles/2.md)