ADAMnetworks articles on DNS, encrypted DNS, network defense, and how Zero Trust Connectivity makes default-deny practical for any device.https://adamnet.works/blog/articles/en-UShttps://adamnet.works/blog/faster-than-real-time/https://adamnet.works/blog/faster-than-real-time/At GITEX 2025, Spire Connect’s Pankaj Sharma asked Francois Driessen what to do when security systems fail. Why even real-time detection is too slow, and how Zero Trust Connectivity denies connections first.Mon, 10 Nov 2025 00:00:00 GMTArticlesZero Trust ConnectivityInterviewGITEXhttps://adamnet.works/blog/preventing-encrypted-dns-filtering-bypass/https://adamnet.works/blog/preventing-encrypted-dns-filtering-bypass/Encrypted DNS hides queries from protective DNS policy. A lab walk-through of Do53, direct-to-IP and allowed DoH URL bypass attempts, and how a local Zero Trust Resolver keeps encryption and enforcement together.Fri, 31 Oct 2025 00:00:00 GMTArticlesEncrypted DNSDoHProtective DNShttps://adamnet.works/blog/dtts-policy-violation-management/https://adamnet.works/blog/dtts-policy-violation-management/In a default-deny network, legacy apps, VoIP and peer-to-peer tools and time-bound connections can fail DTTS checks. The three categories of violation, how traffic logs show them, and how Enablers grant exceptions.Thu, 23 Oct 2025 00:00:00 GMTArticlesDTTSZero Trust DNSadam:ONEhttps://adamnet.works/blog/purdue-2-0-securing-ot-with-zero-trust-connectivity/https://adamnet.works/blog/purdue-2-0-securing-ot-with-zero-trust-connectivity/OT environments face organized crime, nation-state attacks and IT/OT convergence that the Purdue Model and IEC 62443 alone cannot stop. How Zero Trust Connectivity controls egress at every level, with four test cases.Wed, 08 Oct 2025 00:00:00 GMTArticlesOT SecurityPurdue ModelCritical Infrastructurehttps://adamnet.works/blog/dns-txt-records/https://adamnet.works/blog/dns-txt-records/DNS TXT records carry SPF, DKIM and verification data, and now malware and C2 traffic too. Passive DNS analysis of who needs TXT answers, and how adam:ONE blocks them for risky endpoints while allowing the rest.Fri, 15 Aug 2025 00:00:00 GMTArticlesDNS TXTMalwareCommand and Controlhttps://adamnet.works/blog/endpoint-adoption-of-encrypted-dns/https://adamnet.works/blog/endpoint-adoption-of-encrypted-dns/A hands-on test of how far Windows, Android and iOS have adopted encrypted DNS through DDR and DNR, with the adam:ONE lab setup, the queries each platform sends, and what administrators can enable today.Thu, 19 Jun 2025 00:00:00 GMTArticlesEncrypted DNSDDRDNRhttps://adamnet.works/blog/dns-rebind-protection-revisited/https://adamnet.works/blog/dns-rebind-protection-revisited/Yandex and Meta used localhost to track Android users across web and apps. How DNS rebind protection in adam:ONE blocked the Yandex technique by default for years, and how to exempt legitimate private-IP answers.Fri, 13 Jun 2025 00:00:00 GMTArticlesDNS RebindingPrivacyadam:ONEhttps://adamnet.works/blog/unmasking-ech-dns-root-of-trust/https://adamnet.works/blog/unmasking-ech-dns-root-of-trust/Encrypted Client Hello hides the SNI that security tools have used to identify destinations. Why protective DNS only partly fills the gap, and how DNS at the root of trust with DTTS restores control.Thu, 29 May 2025 00:00:00 GMTArticlesECHEncrypted DNSDTTShttps://adamnet.works/blog/hairpin-nat-vs-split-dns/https://adamnet.works/blog/hairpin-nat-vs-split-dns/How hairpin NAT and split-DNS each let internal devices reach a port-forwarded service by its public name, why split-DNS is the safer and faster choice, and how to set it up with an adam:ONE authoritative rule.Wed, 19 Mar 2025 00:00:00 GMTArticlesSplit-DNSNATadam:ONEhttps://adamnet.works/blog/microsegmentation/https://adamnet.works/blog/microsegmentation/From early network segmentation to VLANs, agent-based micro-segmentation and port isolation: why each still leaves lateral movement open without egress control, and how Zero Trust Connectivity closes it.Sat, 15 Mar 2025 00:00:00 GMTArticlesMicrosegmentationLateral MovementZero Trust Connectivityhttps://adamnet.works/blog/dns-server-pinning/https://adamnet.works/blog/dns-server-pinning/DNS server pinning mandates one protective DNS server for every client on a network, whatever its static setting. Why to do it, the cases where it breaks DNS, and the gateway rules for AsusWRT, pfSense and VyOS.Mon, 03 Feb 2025 00:00:00 GMTArticlesDNSNetwork Securityadam:ONEhttps://adamnet.works/blog/infrastructure-laundering-dns-root-of-trust/https://adamnet.works/blog/infrastructure-laundering-dns-root-of-trust/Scam operations hide behind the same cloud infrastructure as legitimate sites. Using a live pig butchering domain on Cloudflare, how Zero Trust Connectivity with DNS as the root of trust blocks it anyway.Thu, 30 Jan 2025 00:00:00 GMTArticlesInfrastructure LaunderingScamsDNShttps://adamnet.works/blog/how-to-block-windows-update/https://adamnet.works/blog/how-to-block-windows-update/How to control when Windows Update can run with a short adam:ONE blocklist, either switched off by hand for maintenance or opened automatically by a weekly schedule, for endpoints that cannot run an agent.Fri, 03 Jan 2025 00:00:00 GMTArticlesWindows UpdatePatch Managementadam:ONEhttps://adamnet.works/blog/dirty-dozen-dns-attacks/https://adamnet.works/blog/dirty-dozen-dns-attacks/Twelve DNS attacks every security team should know, from hijacking and cache poisoning to tunneling, DGAs, rebinding and port 53 abuse, with where adam:ONE has a role in each and where it does not.Thu, 21 Nov 2024 00:00:00 GMTArticlesDNS AttacksDNS SecurityThreat Researchhttps://adamnet.works/blog/dns-resilience-and-network-survivability/https://adamnet.works/blog/dns-resilience-and-network-survivability/A checklist for DNS resilience: high-availability resolvers, multiple Active Directory DNS servers, DNSharmony resolver sets, separate ISP circuits, split resolver pairs and the monitoring that catches failures.Wed, 02 Oct 2024 00:00:00 GMTArticlesDNSResilienceDNSharmonyhttps://adamnet.works/blog/remote-access-tools-hidden-threat/https://adamnet.works/blog/remote-access-tools-hidden-threat/Attackers living off the land use legitimate remote access tools as ready-made C2 channels. A researched list of tools blockable by DNS and DTTS, the self-hosted ones that need Zero Trust Connectivity, and how to allow your own.Tue, 17 Sep 2024 00:00:00 GMTArticlesRemote Access ToolsLiving off the LandDTTShttps://adamnet.works/blog/why-smishing-and-phishing-sites-evade-detection/https://adamnet.works/blog/why-smishing-and-phishing-sites-evade-detection/Phishing operators now hide their sites from sandboxes by serving only mobile carrier IP space and mobile browsers. How that extends a phishing site’s life, and how adam:GO and adam:OSN still protect mobile devices.Tue, 10 Sep 2024 00:00:00 GMTArticlesPhishingSmishingMobile Securityhttps://adamnet.works/blog/dns-over-https-and-dns-over-tls/https://adamnet.works/blog/dns-over-https-and-dns-over-tls/How adam:ONE offers DoH and DoT to internal devices through Discovery of Designated Resolvers, encrypts upstream queries, and uses DTTS so encrypted DNS stays a policy control plane rather than a bypass.Thu, 05 Sep 2024 00:00:00 GMTArticlesEncrypted DNSDoHDoTDTTShttps://adamnet.works/blog/comparing-dns-blocking-methods/https://adamnet.works/blog/comparing-dns-blocking-methods/NXDOMAIN, 0.0.0.0, a dedicated block-page IP or the internal gateway: how protective DNS resolvers answer a blocked query, what each method means for users and SIEMs, and how adam:ONE DNSharmony combines them.Thu, 22 Aug 2024 00:00:00 GMTArticlesDNSProtective DNSDNSharmonyhttps://adamnet.works/blog/microsoft-ztdns-vs-zero-trust-connectivity/https://adamnet.works/blog/microsoft-ztdns-vs-zero-trust-connectivity/How Microsoft’s Zero Trust DNS compares with ADAMnetworks Zero Trust Connectivity, the five ways Windows endpoints can operate, and why gateway and endpoint enforcement work best from one policy pane.Mon, 13 May 2024 00:00:00 GMTArticlesMicrosoft ZTDNSZero Trust ConnectivityDTTShttps://adamnet.works/blog/port-forwarding-and-zero-trust-connectivity/https://adamnet.works/blog/port-forwarding-and-zero-trust-connectivity/Which services are safe to expose through a port forward, which are not, and two ways to make IoT devices, cameras and controllers remotely reachable without exposing them to the whole internet.Fri, 13 Jan 2023 00:00:00 GMTArticlesPort ForwardingIoT SecurityNetwork Securityhttps://adamnet.works/blog/the-telegram-problem/https://adamnet.works/blog/the-telegram-problem/David Redekop and Francois Driessen examine Telegram’s security, privacy and harmful-content risks, from broadcast-scale channels and deepfake bots to its use as a malware command-and-control channel.Mon, 27 Dec 2021 00:00:00 GMTArticlesTelegramHarmful ContentCommand and Controlhttps://adamnet.works/blog/benchmarking-dns-with-adam-one/https://adamnet.works/blog/benchmarking-dns-with-adam-one/A step-by-step method for benchmarking DNS performance behind an adam:ONE gateway with GRC DNS Benchmark, including the temporary firewall rules DTTS needs and a video walk-through on pfSense.Fri, 03 Sep 2021 00:00:00 GMTArticlesDNSPerformanceadam:ONEhttps://adamnet.works/blog/apple-private-relay/https://adamnet.works/blog/apple-private-relay/How Apple Private Relay routes Safari traffic through two relay layers, why it removes network security and content filtering, and how adam:ONE answers mask.icloud.com with NXDOMAIN to keep protection in place.Mon, 21 Jun 2021 00:00:00 GMTArticlesApplePrivate RelayDNS