{"id":28714,"date":"2026-02-26T23:15:35","date_gmt":"2026-02-26T22:15:35","guid":{"rendered":"https:\/\/blog.mi.hdm-stuttgart.de\/?p=28714"},"modified":"2026-02-26T23:32:52","modified_gmt":"2026-02-26T22:32:52","slug":"taking-control-of-dns-over-https","status":"publish","type":"post","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2026\/02\/26\/taking-control-of-dns-over-https\/","title":{"rendered":"Taking Control of DNS over HTTPS"},"content":{"rendered":"\n<p>For decades, enterprise security relied on a simple truth: if you control Port 53, you can see where your users are going. Every DNS query left the network in plaintext, straightforward to log, filter, and block. DNS over HTTPS (DoH), standardized in RFC 8484 [2], broke that model by wrapping name resolution inside standard HTTPS traffic on port 443. Since the standard was published in 2018, DoH has moved from an experimental browser feature to a default setting in major browsers and a natively supported capability in most operating systems.<br>For privacy, this is a real improvement, especially for remote workers on untrusted networks. For corporate IT administrators, it means the DNS-based monitoring and filtering you rely on for security no longer works the way it used to.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-traditional.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"165\" data-attachment-id=\"28773\" data-permalink=\"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2026\/02\/26\/taking-control-of-dns-over-https\/dns-traditional\/\" data-orig-file=\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-traditional.png\" data-orig-size=\"1568,252\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"dns-traditional\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-traditional-1024x165.png\" src=\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-traditional-1024x165.png\" alt=\"\" class=\"wp-image-28773\" srcset=\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-traditional-1024x165.png 1024w, https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-traditional-300x48.png 300w, https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-traditional-768x123.png 768w, https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-traditional-1536x247.png 1536w, https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-traditional.png 1568w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><figcaption class=\"wp-element-caption\">Traditional DNS: The corporate resolver sees and filters every query.<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-doh-bypass.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"165\" data-attachment-id=\"28774\" data-permalink=\"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2026\/02\/26\/taking-control-of-dns-over-https\/dns-doh-bypass\/\" data-orig-file=\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-doh-bypass.png\" data-orig-size=\"1568,252\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"dns-doh-bypass\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-doh-bypass-1024x165.png\" src=\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-doh-bypass-1024x165.png\" alt=\"\" class=\"wp-image-28774\" srcset=\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-doh-bypass-1024x165.png 1024w, https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-doh-bypass-300x48.png 300w, https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-doh-bypass-768x123.png 768w, https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-doh-bypass-1536x247.png 1536w, https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2026\/02\/dns-doh-bypass.png 1568w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><figcaption class=\"wp-element-caption\">DNS over HTTPS: The browser can bypasses corporate DNS entirely. The firewall sees only regular HTTPS traffic.<\/figcaption><\/figure>\n\n\n\n<p>DoH keeps the exact same DNS wire format but secures it using TLS and HTTP for transport [2]. The result is that DoH traffic gets the same protection as any other HTTPS connection. The RFC recommends HTTP\/2 as a minimum to avoid performance hits, which also allows DoH to benefit from newer protocol improvements like HTTP\/3.<br>In practice, a DoH client encodes the DNS message as <code class=\"\" data-line=\"\">application\/dns-message<\/code> and sends it via an HTTP GET or POST request. To simplify integration for web-based applications, providers like Google [3] and Cloudflare [4] additionally offer a JSON API.<br>Querying Cloudflare&#8217;s DoH resolver for <code class=\"\" data-line=\"\">www.hdm-stuttgart.de<\/code> using their JSON API looks like this:<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code class=\"\" data-line=\"\">$ curl -s -H &#039;accept: application\/dns-json&#039; \\\n    &#039;https:\/\/cloudflare-dns.com\/dns-query?name=www.hdm-stuttgart.de&amp;type=A&#039;\n{\n    &quot;Status&quot;: 0,\n    &quot;TC&quot;: false,\n    &quot;RD&quot;: true,\n    &quot;RA&quot;: true,\n    &quot;AD&quot;: false,\n    &quot;CD&quot;: false,\n    &quot;Question&quot;: &#091;\n        {\n            &quot;name&quot;: &quot;www.hdm-stuttgart.de&quot;,\n            &quot;type&quot;: 1\n        }\n    ],\n    &quot;Answer&quot;: &#091;\n        {\n            &quot;name&quot;: &quot;www.hdm-stuttgart.de&quot;,\n            &quot;type&quot;: 1,\n            &quot;TTL&quot;: 3600,\n            &quot;data&quot;: &quot;212.132.79.37&quot;\n        }\n    ]\n}<\/code><\/pre>\n\n\n\n<p>This gets you the exact same result as resolving it locally over traditional DNS, just much more securely:<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code class=\"\" data-line=\"\">$ dig +noedns www.hdm-stuttgart.de A\n\n; &lt;&lt;&gt;&gt; DiG 9.20.19 &lt;&lt;&gt;&gt; +noedns www.hdm-stuttgart.de A\n;; global options: +cmd\n;; Got answer:\n;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 54911\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0\n\n;; QUESTION SECTION:\n;www.hdm-stuttgart.de.        IN    A\n\n;; ANSWER SECTION:\nwww.hdm-stuttgart.de.    325    IN    A    212.132.79.37\n\n;; Query time: 18 msec\n;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)\n;; WHEN: Thu Feb 26 18:27:07 CET 2026\n;; MSG SIZE  rcvd: 54<\/code><\/pre>\n\n\n\n<p>One of the early hurdles for DoH was figuring out how a client actually discovers an encrypted resolver over an initially unencrypted channel. RFC 9463 [5] solved this by allowing networks to advertise their designated encrypted resolvers via DHCP and Router Advertisements.<br>Today, adoption is widespread, and much of it is happening without your IT departments involvement. Firefox enables it by default in several regions using Cloudflare, and Firefox for Android (v143) added it as an opt-in feature recently [6]. Chrome auto-upgrades DNS queries if it detects your system resolver supports DoH.<br>On the OS side, Windows 11 has native DoH support, and Windows Server 2025 just introduced DoH for the DNS Server role in its February 2026 cumulative update (currently in preview) [7]. Apple supports it via MDM profiles, Android has been handling DNS over HTTP\/3 via Mainline module updates since 2022 [8], and on Linux, encrypted DNS is available through systemd-resolved and tools like dnscrypt-proxy.<br>While alternatives like DNS over QUIC (DoQ) [9] exist, the industry has largely settled on DoH over HTTP\/3. Encrypted Client Hello (ECH) [10][11] further reduces what network tools can observe by hiding SNI metadata.<\/p>\n\n\n\n<p>For corporate IT infrastructure, DoH offers some serious security upgrades. TLS encryption stops rogue access points, compromised network segments, or ISPs from observing or modifying DNS queries. When paired with DNSSEC, you get both data authenticity and transport confidentiality.<br>It also stops intermediary networks from interfering with DNS routing. Because DoH runs over port 443, it is very difficult for networks to hijack DNS queries to force suboptimal datacenters. Organizations can finally pick a resolver based purely on policy and performance.<br>Recent standards have closed the remaining gaps: networks can now advertise their encrypted resolvers via DHCP [5], and split-horizon environments can establish local DNS authority without breaking encryption [12]. This means enterprises can route internal queries to local servers and external queries to a protective DNS provider. Running an corporate DoH resolver hooked into threat intelligence allows you to block connections to malicious domains before they establish. The NSA now positions DNS as an active threat detection layer, not just a background utility [13].<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">But..<\/h3>\n\n\n\n<p>The exact properties that make DoH great for privacy, create significant challenges for enterprise monitoring. Traditional security tools rely on seeing plaintext traffic on port 53. If applications bypass the local\/company DNS to use external DoH resolvers, IT entirely loses visibility.<br>Browsers are a primary driver of this bypass. Firefox checks for a canary domain (use-application-dns.net) at startup, if it doesn&#8217;t return NXDOMAIN, Firefox will use DoH by default in several regions [14]. This is an opt-out mechanism that requires active configuration. Chrome&#8217;s behavior operates independently of your corporate DNS unless explicitly overridden by policy.<br>This also creates a practical operational problem. If a browser resolves through a public DoH provider, it cannot reach internal corporate hostnames like <code class=\"\" data-line=\"\">intranet.company.local<\/code>. The result may be confusing helpdesk tickets where internal sites stop working for some users but not others, depending entirely on their browser&#8217;s DNS configuration.<br>Despite encryption, DoH traffic isn&#8217;t completely invisible. Research shows 95% accuracy in website fingerprinting using just the first 50 DoH packets [15], consistent with earlier research [16]. DoH raises the cost of passive surveillance, but it doesn&#8217;t eliminate it.<sup data-fn=\"038bb276-35db-46f1-a762-842d88719710\" class=\"fn\"><a href=\"#038bb276-35db-46f1-a762-842d88719710\" id=\"038bb276-35db-46f1-a762-842d88719710-link\">1<\/a><\/sup><br>Malware authors have also recognized this opportunity. Threat actors now use DoH for covert command-and-control (C2) and data exfiltration. In 2024, the state-linked ShadowPad backdoor was caught using encrypted DNS tunneling [17]. The 2025 Infoblox threat report documents a broader trend of malware adopting encrypted DNS [18]. If your network tools can&#8217;t inspect DoH, these channels are invisible.<br>Market consolidation is another concern. Most public DoH traffic goes straight to Cloudflare and Google. While protocols like Oblivious DoH (ODoH) and Oblivious HTTP (OHTTP) have been created to separate client identity from the resolver, they aren&#8217;t widely deployed yet.<\/p>\n\n\n\n<p>DNS is a legacy protocol that cannot be replaced overnight, but DoH is a highly effective way to modernize it without altering the underlying framework. Since 2018, it has evolved from an experiment into a core OS capability.<br>The trade-off is straightforward: you gain transport security but lose the plaintext visibility you had on Port 53. Waiting is not an option, your browsers are already making DoH requests whether you configured them to or not. The first step is taking control of your DNS layer. Set up DNS middleware like Unbound or CoreDNS as DoH frontends (or use the upcoming Windows Server 2025 capabilities [7]) and hook it into threat intelligence feeds to block known malicious domains before connections establish.<br>At the network edge, you need to block outbound connections to known public DoH resolver IPs. If you don&#8217;t push the <code class=\"\" data-line=\"\">use-application-dns.net<\/code> canary domain to your network, Firefox will route your users&#8217; DNS queries to Cloudflare without asking [14]. Once these blocks are in place, any remaining DoH traffic on your network becomes a high-fidelity signal for intentional evasion or active malware [19].<br>Endpoint management is also important. Browsers can be locked down via Group Policy (Chrome&#8217;s <code class=\"\" data-line=\"\">DnsOverHttpsMode<\/code> policy, for example) or MDM profiles to force the use of internal resolvers. For deeper OS-level control, Microsoft&#8217;s Zero Trust DNS (ZTDNS) [20] ensures all resolution goes through designated encrypted resolvers; administrators configure protective servers using <code class=\"\" data-line=\"\">netsh dnsclient add ztdns<\/code> and can block all other outbound DNS [21].<br>DNS is no longer a passive utility. With DoH becoming the default, you either manage your DNS layer actively or lose visibility into it entirely.<\/p>\n\n\n<ol class=\"wp-block-footnotes\"><li id=\"038bb276-35db-46f1-a762-842d88719710\">These figures come from controlled lab environments. Real-world accuracy is lower due to caching and concurrent connections. <a href=\"#038bb276-35db-46f1-a762-842d88719710-link\" aria-label=\"Jump to footnote reference 1\">\u21a9\ufe0e<\/a><\/li><\/ol>\n\n\n<h4 class=\"wp-block-heading\">References<\/h4>\n\n\n\n<p>[1] P. V. Mockapetris, &#8220;Domain names &#8211; implementation and specification,&#8221; Internet Engineering Task Force, Request for Comments RFC 1035, Nov. 1987. doi: 10.17487\/RFC1035.<br>[2] P. E. Hoffman and P. McManus, &#8220;DNS Queries over HTTPS (DoH),&#8221; Internet Engineering Task Force, Request for Comments RFC 8484, Oct. 2018. doi: 10.17487\/RFC8484.<br>[3] &#8220;Make API requests to 1.1.1.1 over DoH,&#8221; Cloudflare Developers. [Online]. Available: <a href=\"https:\/\/developers.cloudflare.com\/1.1.1.1\/encryption\/dns-over-https\/make-api-requests\/\">https:\/\/developers.cloudflare.com\/1.1.1.1\/encryption\/dns-over-https\/make-api-requests\/<\/a><br>[4] &#8220;JSON API for DNS over HTTPS (DoH),&#8221; Google Developers. [Online]. Available: <a href=\"https:\/\/developers.google.com\/speed\/public-dns\/docs\/doh\/json\">https:\/\/developers.google.com\/speed\/public-dns\/docs\/doh\/json<\/a><br>[5] M. Boucadair, T. Reddy.K, D. Wing, N. Cook, and T. Jensen, &#8220;DHCP and Router Advertisement Options for the Discovery of Network-designated Resolvers (DNR),&#8221; Internet Engineering Task Force, Request for Comments RFC 9463, Nov. 2023.<br>[6] &#8220;Firefox for Android 143.0 Release Notes,&#8221; Mozilla, Sep. 2025. [Online]. Available: <a href=\"https:\/\/www.firefox.com\/en-US\/firefox\/android\/143.0\/releasenotes\/\">https:\/\/www.firefox.com\/en-US\/firefox\/android\/143.0\/releasenotes\/<\/a><br>[7] &#8220;Secure DNS with DoH: Public Preview for Windows DNS Server,&#8221; Microsoft Tech Community, 2026. [Online]. Available: <a href=\"https:\/\/techcommunity.microsoft.com\/blog\/networkingblog\/secure-dns-with-doh-public-preview-for-windows-dns-server\/4493935\">https:\/\/techcommunity.microsoft.com\/blog\/networkingblog\/secure-dns-with-doh-public-preview-for-windows-dns-server\/4493935<\/a><br>[8] &#8220;DNS over HTTP\/3 in Android,&#8221; Google Security Blog, Jul. 2022. [Online]. Available: <a href=\"https:\/\/security.googleblog.com\/2022\/07\/dns-over-http3-in-android.html\">https:\/\/security.googleblog.com\/2022\/07\/dns-over-http3-in-android.html<\/a><br>[9] C. Huitema, S. Dickinson, and A. Mankin, &#8220;DNS over Dedicated QUIC Connections,&#8221; Internet Engineering Task Force, Request for Comments RFC 9250, May 2022.<br>[10] E. Rescorla et al., &#8220;TLS Encrypted Client Hello,&#8221; Internet Engineering Task Force, Internet-Draft draft-ietf-tls-esni-25, 2025. [Online]. Available: <a href=\"https:\/\/datatracker.ietf.org\/doc\/html\/draft-ietf-tls-esni-25\">https:\/\/datatracker.ietf.org\/doc\/html\/draft-ietf-tls-esni-25<\/a><br>[11] &#8220;Announcing Encrypted Client Hello,&#8221; The Cloudflare Blog. [Online]. Available: <a href=\"https:\/\/blog.cloudflare.com\/announcing-encrypted-client-hello\/\">https:\/\/blog.cloudflare.com\/announcing-encrypted-client-hello\/<\/a><br>[12] T. Pauly et al., &#8220;Establishing Local DNS Authority in Validated Split-Horizon Environments,&#8221; Internet Engineering Task Force, Request for Comments RFC 9704, Jan. 2025.<br>[13] &#8220;Adopting Encrypted DNS in Enterprise Environments,&#8221; National Security Agency \/ Cybersecurity and Infrastructure Security Agency, Jan. 2021. [Online]. Available: <a href=\"https:\/\/media.defense.gov\/2021\/Jan\/14\/2002564889\/-1\/-1\/0\/CSI_ADOPTING_ENCRYPTED_DNS_U_OO_102904_21.PDF\">https:\/\/media.defense.gov\/2021\/Jan\/14\/2002564889\/-1\/-1\/0\/CSI_ADOPTING_ENCRYPTED_DNS_U_OO_102904_21.PDF<\/a><br>[14] &#8220;Canary domain &#8211; use-application-dns.net,&#8221; Mozilla Support. [Online]. Available: <a href=\"https:\/\/support.mozilla.org\/en-US\/kb\/canary-domain-use-application-dnsnet\">https:\/\/support.mozilla.org\/en-US\/kb\/canary-domain-use-application-dnsnet<\/a><br>[15] &#8220;Encrypted DNS Traffic Analysis and Classification,&#8221; IEEE Access, vol. 11, 2023. [Online]. Available: <a href=\"https:\/\/ieeexplore.ieee.org\/document\/10165086\/\">https:\/\/ieeexplore.ieee.org\/document\/10165086\/<\/a><br>[16] S. Siby, M. Juarez, C. Diaz, N. Vallina-Rodriguez, and C. Troncoso, &#8220;Encrypted DNS -&gt; Privacy? A Traffic Analysis Perspective,&#8221; in Proc. Network and Distributed Systems Security Symposium (NDSS), 2020. [Online]. Available: <a href=\"https:\/\/arxiv.org\/abs\/1906.09682\">https:\/\/arxiv.org\/abs\/1906.09682<\/a><br>[17] &#8220;Darktrace Detection of State-Linked ShadowPad Malware,&#8221; Darktrace Blog, 2024. [Online]. Available: <a href=\"https:\/\/www.darktrace.com\/blog\/darktrace-detection-of-state-linked-shadowpad-malware\">https:\/\/www.darktrace.com\/blog\/darktrace-detection-of-state-linked-shadowpad-malware<\/a><br>[18] &#8220;DNS Threat Landscape 2025,&#8221; Help Net Security, Aug. 2025. [Online]. Available: <a href=\"https:\/\/www.helpnetsecurity.com\/2025\/08\/12\/dns-threat-landscape-2025\/\">https:\/\/www.helpnetsecurity.com\/2025\/08\/12\/dns-threat-landscape-2025\/<\/a><br>[19] &#8220;DNS over HTTPS: 3 Strategies for Enterprise Security Monitoring,&#8221; Carnegie Mellon University Software Engineering Institute. [Online]. Available: <a href=\"https:\/\/www.sei.cmu.edu\/blog\/dns-over-https-3-strategies-for-enterprise-security-monitoring\/\">https:\/\/www.sei.cmu.edu\/blog\/dns-over-https-3-strategies-for-enterprise-security-monitoring\/<\/a><br>[20] &#8220;Zero Trust DNS is Here: Elevating Enterprise Security on Windows 11,&#8221; Microsoft Tech Community, Feb. 2025. [Online]. Available: <a href=\"https:\/\/techcommunity.microsoft.com\/blog\/networkingblog\/zero-trust-dns-is-here-elevating-enterprise-security-on-windows-11\/4468743\">https:\/\/techcommunity.microsoft.com\/blog\/networkingblog\/zero-trust-dns-is-here-elevating-enterprise-security-on-windows-11\/4468743<\/a><br>[21] &#8220;Deploying Zero Trust DNS,&#8221; Microsoft Learn. [Online]. Available: <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/security\/operating-system-security\/network-security\/zero-trust-dns\/deploying-zero-trust-dns\">https:\/\/learn.microsoft.com\/en-us\/windows\/security\/operating-system-security\/network-security\/zero-trust-dns\/deploying-zero-trust-dns<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>For decades, enterprise security relied on a simple truth: if you control Port 53, you can see where your users are going. Every DNS query left the network in plaintext, straightforward to log, filter, and block. DNS over HTTPS (DoH), standardized in RFC 8484 [2], broke that model by wrapping name resolution inside standard HTTPS [&hellip;]<\/p>\n","protected":false},"author":1091,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"[{\"id\":\"038bb276-35db-46f1-a762-842d88719710\",\"content\":\"These figures come from controlled lab environments. Real-world accuracy is lower due to caching and concurrent connections.\"}]"},"categories":[1],"tags":[1221,306,1031],"ppma_author":[1103],"class_list":["post-28714","post","type-post","status-publish","format-standard","hentry","category-allgemein","tag-dns","tag-dns-over-https","tag-enterprise-it"],"aioseo_notices":[],"jetpack_featured_media_url":"","jetpack-related-posts":[{"id":9526,"url":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2019\/11\/07\/dns-over-https-one-problem-solved-but-a-bunch-of-new-ones-created\/","url_meta":{"origin":28714,"position":0},"title":"DNS over HTTPS: One problem solved, but a bunch of new ones created&#8230;","author":"Ren\u00e9 Schl\u00e4fke","date":"7. November 2019","format":false,"excerpt":"In the course of attending the lecture \u201cSecure Systems\u201d I became aware of a blog post by Geoff Huston on how the Domain Name System (DNS) handles \u201cno such domain name\u201d (NXDOMAIN) responses and which possible attack vectors could result from this. His analysis showed how little effort is necessary\u2026","rel":"","context":"In &quot;Allgemein&quot;","block_context":{"text":"Allgemein","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/category\/allgemein\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2019\/11\/Figure4.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2019\/11\/Figure4.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2019\/11\/Figure4.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2019\/11\/Figure4.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":6535,"url":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2019\/03\/19\/how-internet-giants-deliver-their-data-to-the-world\/","url_meta":{"origin":28714,"position":1},"title":"How internet giants deliver their data to the world","author":"Ren\u00e9 Schl\u00e4fke","date":"19. March 2019","format":false,"excerpt":"In the course of attending the lecture \u201cUltra Large Scale Systems\u201d I was intrigued by the subject of traffic load balancing in ultra-large-scale systems. Out of this large topic I decided to look at traffic distribution at the frontend in detail and held a presentation about it as part of\u2026","rel":"","context":"In &quot;Allgemein&quot;","block_context":{"text":"Allgemein","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/category\/allgemein\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2019\/03\/Figure5.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2019\/03\/Figure5.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2019\/03\/Figure5.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2019\/03\/Figure5.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":3503,"url":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2018\/03\/30\/ci-cd-with-gitlab-ci-for-a-web-application-part-2\/","url_meta":{"origin":28714,"position":2},"title":"CI\/CD with GitLab CI for a web application &#8211; Part 2","author":"Nina Schaaf","date":"30. March 2018","format":false,"excerpt":"GitLab Our first approach was to use the existing GitLab instance of HdM for our project. For them, a shared runner was already defined on which we could run our jobs, so we were able to focus on the CI process itself. This plan worked out at first. We simply\u2026","rel":"","context":"In &quot;DevOps&quot;","block_context":{"text":"DevOps","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/category\/scalable-systems\/devops\/"},"img":{"alt_text":"Shaky Pipeline GitLab","src":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2018\/03\/pipeline-gitlab-1024x156.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2018\/03\/pipeline-gitlab-1024x156.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2018\/03\/pipeline-gitlab-1024x156.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":20290,"url":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2021\/08\/02\/zero-trust-security-the-further-development-of-perimeter-security\/","url_meta":{"origin":28714,"position":3},"title":"Zero Trust Security &#8211; The further development of perimeter security?","author":"Max Merz","date":"2. August 2021","format":false,"excerpt":"Most companies use perimeter security to secure their cooperate applications, services and data from attackers and unauthorised users. This approach includes a cooperate network, where clients, that are part of the network are able to access the applications. This includes attackers that got access to these networks.Additionally more applications are\u2026","rel":"","context":"In &quot;Allgemein&quot;","block_context":{"text":"Allgemein","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/category\/allgemein\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2021\/08\/Windows_365.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2021\/08\/Windows_365.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2021\/08\/Windows_365.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2021\/08\/Windows_365.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":168,"url":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2016\/02\/17\/building_jobs_with_jenkins_and_github_part_3\/","url_meta":{"origin":28714,"position":4},"title":"Jenkbird \u2013 Building jobs with Jenkins and Github \u2013 Part 3","author":"Thomas Derleth","date":"17. February 2016","format":false,"excerpt":"Me want\u00a0Deployment Pipeline. - Cookie Monster \u00a0 In this blog post we will show you, how to set up your first job using Jenkins CI and Github. We will guide you through every single step of the process - including all rookie mistakes we made. Without further ado, let's begin.\u2026","rel":"","context":"In &quot;DevOps&quot;","block_context":{"text":"DevOps","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/category\/scalable-systems\/devops\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2016\/01\/EE28150E9929FD18059D89CF87948B50.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2016\/01\/EE28150E9929FD18059D89CF87948B50.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2016\/01\/EE28150E9929FD18059D89CF87948B50.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2016\/01\/EE28150E9929FD18059D89CF87948B50.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2016\/01\/EE28150E9929FD18059D89CF87948B50.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":3342,"url":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2018\/03\/28\/ci-cd-infrastructure-choosing-and-setting-up-a-server-with-jenkins-as-docker-image\/","url_meta":{"origin":28714,"position":5},"title":"CI\/CD infrastructure: Choosing and setting up a server with Jenkins as Docker image","author":"cp054","date":"28. March 2018","format":false,"excerpt":"Related articles:\u00a0\u25baTake Me Home - Project Overview\u00a0 \u25baAndroid SDK and emulator in Docker for testing\u00a0 \u25baAutomated Unit- and GUI-Testing for Android in Jenkins\u00a0 \u25baTesting a MongoDB with NodeJS, Mocha and Mongoose This article will run you through the motivation for a continuous integration and delivery, choosing a corresponding tool and\u2026","rel":"","context":"In &quot;Allgemein&quot;","block_context":{"text":"Allgemein","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/category\/allgemein\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2018\/03\/puttygen.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2018\/03\/puttygen.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2018\/03\/puttygen.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2018\/03\/puttygen.png?resize=700%2C400&ssl=1 2x"},"classes":[]}],"jetpack_sharing_enabled":true,"authors":[{"term_id":1103,"user_id":1091,"is_guest":0,"slug":"robin_hrle","display_name":"rh080","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/b33347843bce4f587f153b0c6651baa35a5c473373d3f55945e611316840b617?s=96&d=mm&r=g","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/posts\/28714","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/users\/1091"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/comments?post=28714"}],"version-history":[{"count":8,"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/posts\/28714\/revisions"}],"predecessor-version":[{"id":28783,"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/posts\/28714\/revisions\/28783"}],"wp:attachment":[{"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/media?parent=28714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/categories?post=28714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/tags?post=28714"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/ppma_author?post=28714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}