DNS over HTTPs and QUIC

Cisco Secure Firewall enables visibility and control over DNS traffic that uses encryption protocols, including DNS over HTTPS (DoH), and DNS over QUIC (DoQ).

As browsers and operating systems increasingly adopt encrypted DNS protocols, traditional DNS inspection faces visibility gaps. You can use this feature to inspect encrypted DNS traffic over HTTPS (HTTP/1.1, HTTP/2, HTTP/3) and QUIC streams. This allows you to apply DNS Security Intelligence and enforce policies, so you can maintain compliance and protection without compromising privacy

Note

Decryption policy must be configured to inspect DoH and DoQ.

Limitations

  • Sinkhole support: Sinkhole actions support only Type A and AAAA records. For other record types, the connection is closed without an injected packet.

  • Injection: Firewall Threat Defense injects a DNS reply for the "Sinkhole" action and "NX Domain". These injections are not supported for DNS over HTTP/3 and DNS over QUIC. These injections will behave the same as a "Block" action.