NSA & CISA Recommended Protective DNS

Enterprise DNS security.
Zero agents. Ever.

Nantevo delivers authenticated Protective DNS through a novel transport-layer authentication architecture — no endpoint software, no enrollment friction, no attack surface on your devices. Per-client telemetry, MDM-native deployment, and flexible cloud, hybrid, or on-premise infrastructure to meet your organization wherever it operates.

nantevo — live threat monitor // fleet:enterprise-01
nantevo> authenticate client:wks-0x4f2a
endpoint .... ed5491583e45eba7b4778cd.nantevo.com
clientID .... ✓ verified
status ...... authenticated · policy: enterprise-strict
 
roci> monitor queries --live
api.github.com .................. 8ms
prod.datadog.com ................ 11ms
storage.googleapis.com .......... 14ms
 
! anomaly — high-entropy subdomain
xk92mf7.cdn-metrics.net ......... BLOCKED
probable C2 beaconing · incident #4471 logged
 
roci>
<50ms
Typical global query response time — sub-10ms achievable on-premise
2 yrs
Continuous production operation — live infrastructure, not a lab
100%
DNS-over-HTTPS enforced — all resolution encrypted via RFC 8484
0
Endpoint agents required — authentication lives in the transport layer
The problem with incumbent PDNS

Agent-based DNS security
creates the problems it promises to solve.

Every traditional Protective DNS solution — Cisco Umbrella, Infoblox, and their peers — relies on endpoint agents to establish client identity. That architecture carries costs that accumulate across every device, every update cycle, and every unmanaged endpoint in your organization.

Traditional PDNS — agent required

  • Agent binary is itself an exploitable attack surface
  • Failed update cycle leaves devices without protection
  • BYOD and unmanaged devices receive no coverage
  • Kernel extensions increasingly restricted on modern macOS
  • Deployment requires direct access to every endpoint
  • Revocation requires pushing a new policy to the device

Nantevo — authentication in the transport

  • Zero endpoint software — nothing to install, update, or maintain
  • Covers any DoH-capable device, managed or unmanaged
  • Auto-generated MDM profiles for zero-touch Apple fleet enrollment
  • OS-level DoH — system-wide, tamper-resistant, invisible to users
  • Per-client policy and telemetry from the moment of enrollment
  • Instant revocation at the proxy — no device action required
Platform architecture

Four decisions that define
a fundamentally different platform.

Architectural choices — not feature additions — with consequences that compound across every device in your fleet from day one.

01 — Identity

Authentication at the proxy — before the resolver sees anything

Every DoH request is addressed to a unique high-entropy endpoint subdomain and carries a unique ClientID. The reverse proxy validates both before routing to the resolver. Unauthenticated requests receive no response. No software on the device. No enrollment flow. The endpoint itself is the credential.

endpoint: ed5491583e45eba7b4778cd.nantevo.com/{clientID}
validation: reverse proxy — pre-resolver
non-enumerable: endpoint not guessable
unauthenticated traffic: silent drop
02 — Enrollment

MDM profile auto-generation — entire fleet in one push

Nantevo generates per-client MDM profiles containing unique high-entropy DoH endpoints pre-bound to unique ClientIDs. Deploy through your existing Apple MDM. OS-level DoH configures silently, system-wide — every application, every process, every DNS query covered simultaneously, without touching a single device directly.

profile generated → MDM push
scope: OS resolver — all processes
user-visible change: none
time to protected: under 60 seconds
03 — Visibility

Per-client telemetry — not fleet averages

Because every query carries an authenticated identity, threat telemetry is scoped to the individual device. Query patterns, response times, blocked domains, and anomaly scores are per-client in real time. When RoCi identifies a threat, you know the exact device immediately — not which subnet it came from.

telemetry: per authenticated client
anomaly detection: behavioral baseline
alert resolution: individual device
retention: configurable per policy
04 — Infrastructure

Cloud, hybrid, or on-premise — your network, your choice

Nantevo deploys where your DNS belongs. Fully hosted cloud for distributed teams. Hybrid for mixed infrastructure. On-premise virtual appliance for environments where DNS must never leave the network — deployable as a FreeBSD jail, OCI container, or OVA. Custom subdomain endpoints mean the resolver looks like yours.

cloud · hybrid · on-premise appliance
custom endpoint: dns.yourdomain.com
on-premise: queries never leave your DC
CDN outage impact: zero for on-premise
Deployment models

Enterprise DNS security
that fits your infrastructure.

Three deployment models covering every enterprise architecture. Fully hosted to fully air-gapped — with the same authentication architecture, the same per-client telemetry, and the same RoCi threat intelligence across all three.

Model 01 — Cloud

Fully hosted

Nantevo-managed resolvers, globally distributed across redundant infrastructure. Fastest path to deployment. Ideal for distributed workforces, cloud-native organizations, and teams without on-premise DNS infrastructure. Full RoCi threat intelligence and per-client telemetry included.

endpoint: {entropy}.nantevo.com
deployment: MDM profile push
management: Nantevo dashboard
best for: distributed teams, cloud-native
Model 02 — Hybrid

Your subdomain, our intelligence

Your DoH endpoint lives on your own subdomain. A local forwarding layer in your data center handles internal domain resolution. External queries route upstream to Nantevo resolvers. RoCi threat intelligence and unified telemetry operate seamlessly across both layers.

endpoint: dns.yourdomain.com
internal DNS: local resolver
external DNS: Nantevo upstream
best for: hybrid DC, mixed infrastructure
Model 03 — On-Premise

Your network, full control

Complete resolver stack deployed as a virtual appliance in your data center or private cloud. DNS queries never leave your network. Only anonymized RoCi threat signals stream to the intelligence pipeline — not query content. Sub-10ms response times achievable on-network. CDN outages have zero impact.

appliance: jail · container · OVA
queries: air-gapped in your DC
roci: threat signals only, no query data
best for: enterprise DC, high-security
Platform support

Every device in your environment.
Not just your Mac fleet.

Nantevo covers your entire device landscape — from managed corporate fleets to BYOD mobile devices to legacy infrastructure that can't speak DoH. No gaps, no blind spots.

Apple — zero-touch MDM
Auto-generated MDM profiles deploy OS-level DoH silently across iOS and macOS fleets via your existing MDM. System-wide coverage from the moment the profile installs — no user interaction, no visible change.
iOS macOS iPadOS
MDM native
Windows & Android
Windows 11 supports native DoH configuration via Group Policy or manual settings. Android devices connect via the Intra app or native Private DNS, applying per-client credentials transparently on any network.
Windows 11 Android
Native DoH
Browsers
Five major browsers support native DoH configuration, enabling per-client authenticated DNS at the application layer for environments where OS-level configuration is not possible or practical.
Chrome Firefox Brave Edge
Application-level
Linux & BSD
Full DoH support via stub resolver configuration on Linux and BSD systems. Native integration pathway for server fleets, developer workstations, and infrastructure hosts across any distribution.
Linux FreeBSD OpenBSD
Stub resolver
Legacy infrastructure
On-premise forwarder appliance ingests plaintext DNS from legacy devices — printers, IoT, network equipment, older operating systems — and proxies queries through authenticated DoH to Nantevo filtering endpoints. No device left uncovered.
Printers IoT Network gear Legacy OS
Legacy forwarder
Captive portal handling
Hotel and airport networks use portal bypass configuration to allow authenticated portal handshake before DoH enforcement resumes. Corporate travelers remain protected on every network without IT intervention.
Hotel WiFi Airport networks Guest networks
Travel-ready
Deployment lifecycle

Zero to protected fleet.
Three steps. No endpoint access required.

Provision, deploy, and activate protection across your entire fleet without touching a single device directly.

STEP 01

Provision a client profile

Generate a unique MDM configuration profile per client group from the Nantevo dashboard. Each profile contains a unique high-entropy DoH endpoint and bound ClientID. Per-client filtering policy, content categories, and RoCi sensitivity are configured at this stage.

generate_profile(
  client: "eng-fleet",
  policy: "enterprise-strict",
  roci_sensitivity: "high"
) → eng-fleet.mobileconfig
  endpoint: a7f3c91...nantevo.com
STEP 02

Push via your existing MDM

Deploy the generated profile through your Apple MDM infrastructure. The profile installs silently at OS level across your entire fleet simultaneously. No user interaction. No application download. OS-level DoH configures system-wide — every application and every process is covered from the moment of installation.

MDM push → profile installs
scope: OS resolver — all processes
user interaction: none required
fleet coverage: immediate
STEP 03

Every query authenticated and monitored

From the moment the profile installs, every DNS query from that device is encrypted, authenticated at the proxy layer, filtered against live threat intelligence, and logged to your per-client telemetry dashboard. RoCi monitors behavioral patterns continuously and surfaces threats in real time.

device → DoH → proxy auth check
→ resolver → RoCi analysis
→ response + metadata log
typical latency: under 50ms
Intelligence layer

RoCi — AI threat intelligence
built into the resolver.

RoCi is Nantevo's onboard threat intelligence engine. She analyzes per-client DNS query behavior continuously, identifies anomalies against established baselines, and classifies threats in real time — across every authenticated client simultaneously, without adding latency to the query path.

DGA Detection
High-entropy subdomain patterns consistent with domain generation algorithms used in C2 malware and ransomware staging
C2 Beaconing
Periodic query patterns to novel or suspicious infrastructure characteristic of botnet command and control traffic
DNS Tunneling
Anomalous TXT record query volumes and high-frequency lookups to newly-registered domains indicating exfiltration
Behavioral Anomaly
Per-client baseline modeling surfaces volume spikes, novel domain clusters, and off-hours patterns that fleet-level solutions miss
roci — behavioral analysis // wks-0x4f2a
roci> analyze client:wks-0x4f2a --deep
baseline ......... 2,400 queries/day
today ............ 2,847 — normal range
✓ latency p99 .... 31ms
✓ phishing blocked 12
✓ malware blocked .. 26
 
! anomaly detected — 14:32 UTC
query: xk92mf7a3n.cdn-analytics.net
entropy: 4.2 (threshold: 3.5)
classification: probable DGA / C2
✗ BLOCKED · incident #4471 logged
 
threat score: LOW · continue monitoring
Data & logging policy

Configurable retention. No surveillance. No third-party sharing.

Enterprise security teams need logs. Nantevo gives you control over exactly what is retained, for how long, and where — without ever using your data for anything other than your own security operations.

Query metadata — logged by default
Timestamp, authenticated client ID, response code, resolution latency, and threat classification are logged for every query. This is the telemetry that powers RoCi's behavioral analysis and your incident response workflows. Retention window is configurable per policy.
Configurable retention
Query content — off by default, available on request
The actual domain being resolved is not logged in default configuration. Organizations with compliance requirements that mandate full DNS query logging can enable content logging with configurable retention. On-premise deployments keep all content data within your network boundary.
Off by default
Third-party sharing — never
Your DNS telemetry is never shared with, sold to, or accessible by any third party. It is not used for advertising, profiling, or any purpose outside of your own security operations. On-premise deployments ensure no query data ever leaves your infrastructure.
Zero data sharing

Compliance & framework alignment

NSA / CISA PDNS
Aligned with NSA and CISA Protective DNS guidance for federal agencies and enterprise environments
NIST Zero Trust
Per-client authenticated DNS supports Zero Trust architecture — verify every request, trust nothing implicitly
RFC 8484 DoH
All DNS resolution transmitted over encrypted DNS-over-HTTPS. Initial endpoint discovery uses standard DNS; all subsequent resolution is fully encrypted
Configurable Retention
Logging policy configurable to meet your compliance requirements — from minimal metadata to full query content with defined retention windows

What security teams say

"We evaluated three PDNS vendors. Nantevo was the only one that didn't require software on every device. For a team of 200 across four continents, that difference in deployment complexity was the decision."

— Director of Security Engineering, global SaaS company

"The per-client telemetry caught a compromised laptop within hours of enrollment — something our previous solution would have averaged out of the fleet-level data. RoCi's behavioral baseline is genuinely different."

— VP Engineering, Series C fintech

"The on-premise appliance was the deciding factor. Our DNS doesn't leave our data center, we get full RoCi intelligence, and a CDN outage has zero impact on our resolution path. That's the architecture we needed."

— CISO, regulated financial services firm

Reliability

Production-proven. Not a promise — a record.

Two years of continuous operation across globally distributed infrastructure. These are live production metrics from the same platform your organization will run on.

99.97%
Resolver uptime — trailing 24 months
VERIFIED · status.nantevo.com
<50ms
Typical global query response — sub-10ms on-premise
PRODUCTION TELEMETRY
Global
Anycast distribution — redundant infrastructure, multi-region
CLOUD · HYBRID · ON-PREMISE
Resolver availability99.97%
Proxy authentication layer100.0%
RoCi threat intelligence99.94%
Per-client telemetry pipeline99.89%

See Nantevo authenticate a fleet
in under 60 seconds.

Live demo. Your devices. No software installed before, during, or after.