Perspectives
Technical perspectives on DNS, Zero Trust Connectivity, and modern network defense.
1–12 of 24
RSS
At GITEX 2025, Spire Connect’s Pankaj Sharma asked Francois Driessen what to do when security systems fail. Why even real-time detection is too slow, and how Zero Trust Connectivity denies connections first.
Encrypted DNS hides queries from protective DNS policy. A lab walk-through of Do53, direct-to-IP and allowed DoH URL bypass attempts, and how a local Zero Trust Resolver keeps encryption and enforcement together.
In a default-deny network, legacy apps, VoIP and peer-to-peer tools and time-bound connections can fail DTTS checks. The three categories of violation, how traffic logs show them, and how Enablers grant exceptions.
OT environments face organized crime, nation-state attacks and IT/OT convergence that the Purdue Model and IEC 62443 alone cannot stop. How Zero Trust Connectivity controls egress at every level, with four test cases.
DNS TXT records carry SPF, DKIM and verification data, and now malware and C2 traffic too. Passive DNS analysis of who needs TXT answers, and how adam:ONE blocks them for risky endpoints while allowing the rest.
A hands-on test of how far Windows, Android and iOS have adopted encrypted DNS through DDR and DNR, with the adam:ONE lab setup, the queries each platform sends, and what administrators can enable today.
Yandex and Meta used localhost to track Android users across web and apps. How DNS rebind protection in adam:ONE blocked the Yandex technique by default for years, and how to exempt legitimate private-IP answers.
Encrypted Client Hello hides the SNI that security tools have used to identify destinations. Why protective DNS only partly fills the gap, and how DNS at the root of trust with DTTS restores control.
How hairpin NAT and split-DNS each let internal devices reach a port-forwarded service by its public name, why split-DNS is the safer and faster choice, and how to set it up with an adam:ONE authoritative rule.
From early network segmentation to VLANs, agent-based micro-segmentation and port isolation: why each still leaves lateral movement open without egress control, and how Zero Trust Connectivity closes it.
DNS server pinning mandates one protective DNS server for every client on a network, whatever its static setting. Why to do it, the cases where it breaks DNS, and the gateway rules for AsusWRT, pfSense and VyOS.
Scam operations hide behind the same cloud infrastructure as legitimate sites. Using a live pig butchering domain on Cloudflare, how Zero Trust Connectivity with DNS as the root of trust blocks it anyway.