Thanks for your comment. The main purpose of the article is to shed some light on the DNS as a perfect tool to help increase security for enterprises. As part of the zero-trust approach, DNS can help in segmenting the application access and have a detailed view of the intent of user clients.

DNSSEC is effectively a good way to add integrity control on the DNS information transported. DNS over TLS would bring confidentiality at the transport level, but clients need to be updated first in the operating systems.

Flow analysis with advanced methods like neural networks or clustering is also an approach to look at. We at EfficientIP are investing a lot in these directions to increase our detection ability of bad domains (such as zero-day malicious domains or DGA) and non-conforming behavior of applications.

Trusting the DNS providers is probably not enough in the space of the enterprise. The distributed model of the DNS is not easy to centralize (nor a good option for Internet service continuity). Enterprises have not (and will not) moved all their workloads and data into cloud infrastructures- some require a higher level of control on their resources, some are not trusting providers for data security. Internal enterprise DNS is still a perfect way to increase security with filtering, segmenting the access to application and analyzing user behaviors. Feeding SIEM with events from the DNS, and some logs in special circumstances, provides a good way to enhance security for enterprise assets and data as a whole. This is the main purpose of security in IT.

Having a granular view of users and applications becomes a standard approach, not an exception. Almost all Internet connections are initiated through DNS, meaning DNS sees 95% of traffic going through the network. Analyzing the behavior of each user brings valuable data for detecting potential menaces hidden in the traffic. This surveillance of each client at such a detailed level is key to successful zero-trust strategy. Plus, administrators also should know the status of the network in real time at all times. 

• Implemented IPv6 to run in most if not all of our environment (enable AES256 VPN ESP/AH Connections to your offsite locations)
• Implement DNSSEC as part of your DNS solution where keys are exchanged
• Work with companies like Infobox to help address some of your issues
• Implement ML as part of your cybersecurity strategy at the DNS and network layers
•