๐จ๐ณcnBeta (Full RSS)โขStalecollected in 3h
Windows Server 2025 Adds DNS over HTTPS Support
๐กSecure your AI infrastructure: Windows Server 2025 now supports encrypted DNS to protect your network traffic.
โก 30-Second TL;DR
What Changed
DNS over HTTPS (DoH) is now officially available in Windows Server 2025
Why It Matters
Enhanced DNS security is vital for enterprise AI clusters that rely on secure, authenticated network communication to prevent man-in-the-middle attacks.
What To Do Next
Update your server infrastructure to Windows Server 2025 and enable DoH to secure your internal AI model deployment pipelines.
Who should care:Developers & AI Engineers
Key Points
- โขDNS over HTTPS (DoH) is now officially available in Windows Server 2025
- โขProvides encrypted protection for DNS communication to prevent tampering
- โขBrings parity with Windows client OS security features to the server environment
๐ง Deep Insight
Web-grounded analysis with 19 cited sources.
๐ Enhanced Key Takeaways
- โขDNS over HTTPS (DoH) in Windows Server 2025 reached General Availability with the June 9, 2026 cumulative update (KB5094125), making it stable for production environments.
- โขThis implementation specifically encrypts client-to-resolver DNS traffic within on-premises Windows DNS environments, closing a six-year gap where internal DNS queries remained unencrypted despite DoH adoption by browsers for external resolvers.
- โขThe feature authenticates the DNS server's identity using TLS certificates, which helps prevent DNS spoofing and impersonation attacks.
- โขMicrosoft designed the DoH integration for gradual adoption, allowing traditional unencrypted DNS to operate concurrently with DoH within the same server environment.
- โขServer-side configuration for DoH in Windows Server 2025 primarily relies on PowerShell cmdlets for tasks such as certificate binding and protocol activation, as a graphical user interface is not yet available.
๐ ๏ธ Technical Deep Dive
- DoH is a proposed standard, RFC 8484 (October 2018), which encapsulates DNS messages within HTTPS, using the MIME type
application/dns-message. - It operates over TCP port 443, the standard port for HTTPS, making DNS traffic indistinguishable from regular web traffic.
- Implementing DoH on Windows Server 2025 requires a valid TLS certificate with the Server Authentication (1.3.6.1.5.5.7.3.1) Enhanced Key Usage extension and a Subject Alternative Name (SAN) matching the configured DoH URI template.
- Server-side setup involves PowerShell cmdlets for tasks such as importing the certificate, binding it to port 443, configuring firewall rules, and enabling the DoH protocol with a specific URI template.
- The current DoH implementation in Windows Server 2025 encrypts communication between DoH-capable clients (e.g., Windows 11) and the Windows DNS Server, but does not yet extend to encrypted communication between the Windows DNS Server and upstream DNS resolvers.
- DoH does not alter the fundamental DNS query and response model; instead, it modifies how DNS messages are transported across the network.
- Windows clients can be configured to use DoH via network settings or Group Policy, offering options like 'Encrypted only,' 'Encrypted preferred,' or 'Unencrypted only' for DNS encryption.
๐ฎ Future ImplicationsAI analysis grounded in cited sources
Enterprise adoption of Zero Trust architectures will accelerate due to native DoH support.
The availability of DoH in Windows Server 2025 provides a native, Microsoft-supported solution for encrypting internal DNS traffic, a critical component for achieving Zero Trust network security.
Organizations will gain enhanced control over encrypted DNS traffic within their managed environments.
By enabling internal DoH resolvers, enterprises can offer encrypted DNS without surrendering policy control or losing visibility to external public DoH services.
Future Windows Server updates will likely introduce encrypted communication for upstream DNS resolver queries.
Microsoft has indicated plans to extend DoH support to encrypt communication between the Windows DNS Server and upstream DNS resolvers in a future update, although no specific timeline has been announced.
โณ Timeline
2018-10
IETF publishes RFC 8484, standardizing DNS over HTTPS (DoH).
2019-11
Microsoft announces plans to implement DoH support in the Windows DNS client.
2020-05
Microsoft releases Windows 10 Insider Preview Build 19628, including initial DoH client support.
2021-06
Windows Insiders gain new DoH controls for the Windows DNS client, including UI and Group Policy options.
2026-02
Microsoft releases a public preview of DoH support for the Windows Server DNS service in Windows Server 2025 (KB5075899 update).
2026-06
DoH support for Windows DNS Server in Windows Server 2025 becomes generally available with the June 9, 2026 cumulative update (KB5094125).
๐ Sources (19)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
๐ฐ
Weekly AI Recap
Read this week's curated digest of top AI events โ
๐Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: cnBeta (Full RSS) โ