Question

A security architect discovers that several endpoints on the corporate network are using DNS over HTTPS (DoH) configured directly in their browsers, bypassing the organization's internal DNS resolvers. The security team relies on those resolvers to log queries, block known malicious domains, and detect DNS-based command-and-control traffic. Which consequence represents the MOST significant security concern the architect should address?

Accepted Answer

DoH encrypts DNS queries to external resolvers, blinding the organization's DNS-based monitoring and domain-filtering controls and enabling covert C2 and exfiltration channels

Answer

DoH increases DNS resolution latency, degrading application performance for cloud-hosted services

Answer

DoH prevents the use of DNSSEC, allowing cache-poisoning attacks against endpoint resolvers

Answer

DoH forces all endpoints to fall back to plaintext DNS on port 53, exposing queries to on-path interception