Integrating DNS and SDP: Enhanced Zero Trust Policy Enforcement 2.0

The Domain Name System (DNS) is a foundational internet service and a persistent security blind spot in enterprise environments. Traditional DNS concepts relied solely on network access for trust, but the industry is now moving aggressively to adopt encrypted DNS (DNS over HTTPS and DNS over TLS). While DNS over HTTPS (DoH) and DNS over TLS (DoT) improve the confidentiality of DNS queries, they do not provide the identity awareness, policy enforcement, auditability, or service concealment required by modern Zero Trust Architectures (ZTA). This paper shifts some of the focal points of the original Integrating SDP and DNS Zero Trust paper (https://cloudsecurityalliance.org/artifacts/integrating-sdp-and-dns-enhanced-zero-trust-policy-enforcement) towards a more advanced Policy Enforced-based architectural pattern. This new architectural pattern applies modern Zero Trust and Software-Defined Perimeter (SDP) principles to DNS over HTTPS/TLS, transforming DNS from a passive resolution mechanism into an identity-aware, policy-enforced control point. By integrating DNS resolution with certificate-based authentication, enterprise Identity and Access Management (IAM), and context-based access decisions, and by enforcing authorization decisions before resolution and, where the architecture supports it, returning gateway or rendezvous information for authorized clients, identity-first overlay fabrics, and other Zero Trust enforcement layers, this approach enables fine-grained control, improved visibility, and stronger alignment with authenticate-before-connect and service-hiding requirements. The paper examines architecture, threat models, failure modes, privacy implications, and standards alignment, and clarifies that Secure Multi-Step DoH functions strictly as a pre-resolution Zero Trust control. It governs service discovery and name resolution but does not establish, authorize, or maintain application sessions. It complements, but does not replace, downstream access and session enforcement mechanisms such as SDP, NHP, ZTNA, identity-first overlays (e.g., OpenZiti/NetFoundry), and SASE/SSE architectures. The paper further explores how this layered model integrates with emerging frameworks such as Agent Name Services (ANS), enabling globally distributed workforces to securely resolve and access internal resources without relying on traditional VPN architectures.