How to block DoH with BlueCat’s threat feed option

The use of DNS over HTTPS (DoH) is surging. That’s bad news for security admins. If you’re looking to block DOH, BlueCat’s threat feed makes it easy.


April 30, 2020

DNS over HTTPS (DoH) is a method of encrypting DNS queries that has gained a lot of traction recently. In February 2020, DoH was added as a default setting in the Firefox browser.

Now ordinary users are jumping on the bandwagon. When the pandemic left everyone working from home, BlueCat noticed a 1,500% increase in DoH domain queries across its customer base. That dramatic surge in DoH usage continues to this day.

Opinions vary on the benefits of DoH, but one thing’s for sure: It reduces the visibility of network and security administrators to zero. If you’re charged with protecting a corporate network, you’re probably going to want to prevent users from accessing DoH services across the enterprise.

If you’re using a centralized DNS management platform like BlueCat, it’s easy to block DoH by adding known DoH resolvers to a response policy zone (RPZ). The longer-term challenge is adding any new DoH services that appear in the future to that block list.

BlueCat has made it easy by creating a new threat feed specifically for known DoH resolvers. BlueCat has long used threat feeds to bolster defense-in-depth. To disable DoH across the enterprise, all you have to do is enable this threat feed for DoH in either DNS Edge or DNS Integrity, and you’ll be all set. 

How to deploy the DoH threat feed in DNS Integrity

  1. Log into BlueCat Address Manager.
  2. Select the DNS tab. Tabs remember the page you last worked on, so select the tab again to ensure you’re on the configuration information page.
  3. Under DNS Views, click a DNS View and then the Response Policy Zones sub-tab.
  4. Under Response Policy Zones, click New and select Response Policy Zone.
  5. Under General, add the name of the response policy zone.
  6. Under Type, select the “BlueCat Threat Protection DoH Public Servers” option and apply other deployment parameters as desired.
  7. Click update.

How to deploy the DoH threat feed in DNS Edge

  1. Log into the DNS Edge user interface.
  2. In the top navigation bar, select Policies.
  3. Select an existing policy that uses the BlueCat Threat Protection domain list, and click Edit.
  4. Select the BlueCat Threat Protection DoH Public Servers option.
  5. Click save and apply.

BlueCat is keeping an eye out for any new DoH resolvers and adding them to the threat feed. As a result, you’re covered even as DoH usage evolves.

Our care portal contains more information about DoH threat feed options, including detailed technical notes. You can also learn more about the pros and cons of DoH in a webinar with BlueCat’s Chief Strategy Officer Andrew Wertkin.

Published in:

An avatar of the author

BlueCat is the Adaptive DNS company. The company’s mission is to help organizations deliver reliable and secure network access from any location and any network environment. To do this, BlueCat re-imagined DNS. The result – Adaptive DNS – is a dynamic, open, secure, scalable, and automated DDI management platform that supports the most challenging digital transformation initiatives, like adoption of hybrid cloud and rapid application development.

Related content

Detect anomalies and CVE risks with Infrastructure Assurance 8.4 

The Infrastructure Assurance 8.4 release features an anomaly detection engine for outliers and a CVE analysis engine to uncover device vulnerabilities.

Read more

Get fast, resilient, and flexible DDI management with Integrity 9.6

With Integrity 9.6, network admins can get support for new DNS record types, architect and configure multi-primary DNS, and automate IP assignments.

Read more

Deepen your security insight with Infrastructure Assurance 8.3

BlueCat Infrastructure Assurance 8.3, with an enhanced analytics dashboard, including interactive widgets and top 10 alerts, is now available.

Read more

Security, automation, cloud integration keys to DDI solution success

Only 40% of enterprises believe they are fully successful with their DDI solution. Learn how to find greater success with new research from EMA and BlueCat.

Read more

Our commitment to Micetro customers and product investment

From CEO Stephen Devito, a word on BlueCat’s ongoing commitment to supporting Micetro customers and Micetro’s evolution as a network management tool.

Read more

Seven reasons to rethink firewall monitoring and boost automation 

With BlueCat Infrastructure Assurance, you can better protect your network with automated alerts and suggested remedies for hidden issues in your firewalls.

Read more