Zero-Trust DNS

This piece outlines Microsoft’s Zero-Trust DNS (ZTDNS), which integrates the Windows DNS engine with the Windows Filtering Platform to enable per-domain firewall updates and enforce the use of a protective, TLS-based DNS that only resolves allow-listed domains and necessary subnets; experts describe it as a bidirectional API for triggering firewall actions and external responses, offering a scalable way for organizations to lock down DNS.