DNS hygiene notes for a zero-trust network

Nathan Chadwick · July 22, 2025 · 1 min read

TLDRRead the short version

Log queries at resolvers you control and consider a protective DNS service.
Unexpected NXDOMAIN bursts often precede larger issues, so watch for them.
Align internal zones with device trust signals rather than mirroring the public internet blindly with flat internal DNS.

Visibility#

Log queries at resolvers you control, and consider a protective DNS service. Unexpected NXDOMAIN bursts often precede larger issues.

Align internal zones with device trust signals; avoid flat internal DNS that mirrors the public internet blindly.

Sources and further reading for the claims above.