NSA & CISA Recommended Protective DNS

Enterprise DNS security.
Zero agents.

Nantevo delivers authenticated Protective DNS through a novel transport-layer architecture — no endpoint software, no enrollment friction, no attack surface on your devices. Per-client 1:1 attribution, MDM-native deployment, and cloud, hybrid, or on-premise infrastructure aligned to NIST SP 800-81r3.

91%
of malware uses DNS for command-and-control, data exfiltration, or traffic redirection. DNS is the most consistently exploited attack channel — and the most consistently under-secured. The NSA and CISA have explicitly recommended Protective DNS as a foundational enterprise security control. Cisco Annual Security Report · NSA & CISA PDNS guidance, 2021
nantevo — live threat monitor // fleet:enterprise-01
nantevo> authenticate client:k7mxr4bqe9yz2pt6w3dh8cf5a
endpoint .... r7mxk4bqe9yzw2nt6p3dh8f5a.nantevo.com
clientID .... ✓ verified · 1:1 attribution
status ...... authenticated · policy: enterprise-strict
 
roci> monitor queries --live
api.github.com .................. 9ms
prod.datadog.com ................ 12ms
storage.googleapis.com .......... 16ms
 
! C2 kill chain detected — 14:32 UTC
xk92mf7.cdn-metrics.net ......... BLOCKED
DGA/C2 · incident #4471 · device identified: immediate
 
roci>
~16ms
Average production query response — measured over 2.5 years of live operation
2.5 yrs
Continuous production operation — live infrastructure since October 2023
~25%
Of all queries blocked by ad & tracker filtering — production fleet average
0
Endpoint agents required — authentication lives in the transport layer
The DNS security problem

Two gaps incumbent solutions
leave open. One architecture that closes both.

Traditional Protective DNS fails at the deployment model. Browsers independently implementing their own DoH bypass corporate controls entirely. Nantevo's transport-layer authentication architecture eliminates both problems simultaneously.

Agent-based PDNS

  • Agent binary is itself an exploitable attack surface
  • Failed update cycle leaves devices without protection
  • BYOD and unmanaged devices receive no coverage
  • Kernel extensions increasingly restricted on modern macOS
  • Deployment requires direct access to every endpoint
  • Revocation requires pushing a new policy to the device

The Encrypted DNS Gap

  • !Chrome, Firefox, and Brave implement their own DoH — bypassing corporate resolvers entirely
  • !SOC loses DNS telemetry visibility for browser traffic — the majority of user queries
  • !No filtering policy can be enforced on traffic the resolver never sees
  • !Roaming device DNS is typically plaintext — 0% encrypted in our pre-deployment audit
  • !ISP DNS resolvers have no threat intelligence — unfiltered malicious domains resolve freely

Nantevo — transport-layer auth

  • Zero endpoint software — nothing to install, update, or maintain
  • MDM-enforced OS-level DoH overrides browser DoH — closes the encrypted gap
  • Covers any DoH-capable device, managed or unmanaged
  • 1:1 attribution — every query tagged to a specific authenticated device
  • DNS as a Policy Enforcement Point — Zero Trust at the resolution layer
  • Instant revocation at the proxy — no device action required
Projected business impact

Security that pays for itself
before you count the breaches prevented.

These projections extrapolate 2.5 years of production telemetry to a 500-employee fleet. Ad and tracker filtering doesn't just reduce the attack surface — it removes bandwidth and latency overhead from every device on your network. Ad networks are a well-documented malvertising delivery channel; blocking them at the resolver is a security control, not a convenience feature.

~730 GB
Projected enterprise bandwidth saved per month
500-employee hybrid workforce · 25% block rate
~34 hrs
Projected rendering latency recovered per month
Extrapolated from production blocking telemetry
~25%
Of all DNS queries blocked — ad, tracker, and malvertising networks
Production fleet average · October 2023 – present
100M
Projected monthly queries at 500-employee enterprise scale
Extrapolated from 10-user pilot baseline data
Global Cyber Alliance research found that DNS-layer filtering could prevent roughly a third of data breaches, and the FBI has warned that malicious search-engine ads impersonating brands are a common attack vector. The bandwidth and latency savings are a byproduct of closing that attack surface. At enterprise scale, those savings offset a significant portion of deployment cost. Sources: Global Cyber Alliance, The Economic Value of DNS Security (2019); FBI IC3 PSA I-122122 (2022).
Platform architecture

Four decisions that define
a fundamentally different platform.

Architectural choices — not feature additions — with consequences that compound across every device in your fleet from day one.

01 — Identity

Authentication at the proxy — before the resolver sees anything

Every DoH request carries a unique high-entropy endpoint subdomain and ClientID. The reverse proxy validates both before routing to the resolver. Unauthenticated requests receive no response — not an error, silence. DNS is treated as a Policy Enforcement Point in the Zero Trust sense: no query proceeds without verified identity. Per NIST SP 800-207, no network is inherently trusted.

endpoint: r7mxk4bqe9yzw2nt6p3dh8f5a.nantevo.com/{clientID}
validation: reverse proxy — pre-resolver
framework: NIST ZTA — Policy Enforcement Point
unauthenticated traffic: silent drop
02 — Enrollment

MDM profile auto-generation — entire fleet in one push

Nantevo generates per-client MDM profiles containing unique high-entropy DoH endpoints pre-bound to unique ClientIDs. Deploy through your existing Apple MDM. OS-level DoH configures silently, system-wide — overriding browser-level DoH, covering every application and process simultaneously. The Encrypted DNS Gap closes the moment the profile installs.

profile generated → MDM push
scope: OS resolver — overrides browser DoH
user interaction: none required
time to protected: under 60 seconds
03 — Visibility

1:1 attribution — not fleet averages

Because every query carries an authenticated client identity, threat telemetry is scoped to the individual device. When RoCi detects a C2 beacon, the SOC gets the exact device, exact timestamp, and exact domain immediately — without needing network access or VPN correlation. This is what eliminates the visibility gap that slows incident response on agent-free competitor platforms.

attribution: 1:1 per authenticated device
SOC value: exact device on C2 detection
device identification: immediate
no VPN or IP correlation required
04 — Intelligence

RoCi — behavioral AI that never touches a live query

RoCi analyzes the telemetry log stream asynchronously — after responses are already delivered. This is an architectural constraint, not a limitation: DNS resolution latency is a hard constraint, AI inference is not. RoCi's detections update the synchronous threat feed, building a defense-in-depth stack that improves with every detection across every client.

roci: async log analysis only
query path: lookup only, never inference
detection → rule push → feed update
architecture: Defense in Depth
Deployment models

Cloud, hybrid, or on-premise.
Your infrastructure requirements drive the choice.

The same authentication architecture and RoCi intelligence operate across all three models. What changes is where the resolver runs and where DNS queries travel.

Model 01 — Cloud

Nantevo-hosted resolvers

Globally distributed resolver nodes across the US with expansion roadmap to 32 locations. MDM profile push for zero-touch Apple fleet enrollment. Fastest path to full fleet protection — operational within hours of decision. All RoCi intelligence and per-client telemetry included.

endpoint: {entropy}.nantevo.com
deployment: MDM profile push
queries: Nantevo cloud infrastructure
best for: distributed teams, cloud-native
Model 02 — Hybrid

Your subdomain, our intelligence

Your DoH endpoint lives on your own subdomain. A local forwarding layer in your data center handles internal domain resolution. External queries route upstream to Nantevo resolvers. RoCi threat intelligence and unified per-client telemetry operate seamlessly across both layers.

endpoint: dns.yourdomain.com
internal DNS: local resolver
external DNS: Nantevo upstream
best for: hybrid DC, mixed infrastructure
Model 03 — On-Premise

Air-gapped resolver

Complete resolver stack deployed as a virtual appliance in your data center. DNS queries never leave your network. Only anonymized RoCi threat signals stream outbound — query content never crosses your boundary. Sub-10ms response times on-network. CDN outages have zero impact on resolution.

appliance: jail · container · OVA
queries: air-gapped in your DC
roci: threat signals only, no query data
best for: regulated, high-security, DC
Platform support

Every device in your environment.
Proven in production across all of them.

Device coverage was proven with real households and real devices — not claimed on a spec sheet. Every category below has been operational in production since October 2023.

Apple — zero-touch MDM
Auto-generated MDM profiles deploy OS-level DoH silently across iOS and macOS fleets via your existing MDM. System-wide coverage overrides browser DoH — closing the Encrypted DNS Gap at enrollment. No user interaction, no visible change.
iOSmacOSiPadOS
MDM native · production proven
Windows & Android
Windows 11 supports native DoH configuration via Group Policy. Android devices connect via the Intra app or native Private DNS, applying per-client credentials transparently on any network.
Windows 11Android
Native DoH · production proven
Browsers
All major browsers support native DoH configuration for environments where OS-level MDM configuration is not practical. Closes the Encrypted DNS Gap for unmanaged device scenarios.
ChromeFirefoxBraveEdgeSafari
Application-level · production proven
Linux & BSD
Full DoH support via stub resolver configuration. Native integration pathway for server fleets, developer workstations, and infrastructure hosts across any distribution.
LinuxFreeBSDOpenBSD
Stub resolver · production proven
Home routers & network-wide
Router-level deployment provides network-wide protection for every device on the network — including smart TVs, IoT, and anything else that makes DNS queries. Proven in production across household networks since 2023.
Home routersIoTSmart TVs
Network-wide · production proven
Legacy infrastructure
On-premise forwarder appliance ingests plaintext DNS from legacy devices and proxies queries through authenticated DoH to Nantevo filtering endpoints. No device left without coverage.
PrintersNetwork gearLegacy OS
Legacy forwarder
Deployment lifecycle

Zero to protected fleet.
Three steps. No endpoint access required.

Provision, deploy, and activate protection across your entire fleet without touching a single device directly.

STEP 01

Provision a client profile

Generate a unique MDM configuration profile per client group from the Nantevo dashboard. Each profile contains a unique high-entropy DoH endpoint and bound ClientID — 128-bit entropy per credential, combined authentication required. Per-client filtering policy, content categories, and RoCi sensitivity are configured at this stage.

generate_profile(
  client: "eng-fleet",
  policy: "enterprise-strict",
  roci_sensitivity: "high"
) → eng-fleet.mobileconfig
  entropy: 128-bit per credential
STEP 02

Push via your existing MDM

Deploy through your Apple MDM infrastructure. The profile installs silently at OS level, overriding browser DoH configuration system-wide. No user interaction. No application download. Every application, every process, every DNS query covered simultaneously — including browsers that would otherwise use their own DoH resolver.

MDM push → profile installs
scope: OS resolver — overrides browser DoH
encrypted DNS gap: closed
fleet coverage: immediate
STEP 03

Every query authenticated, monitored, attributed

From the moment the profile installs, every DNS query is encrypted, authenticated at the proxy, filtered against live threat intelligence, and logged with 1:1 device attribution. RoCi monitors behavioral patterns asynchronously — never in the query path — and surfaces threats with the exact device identity needed to begin containment immediately.

device → DoH → proxy: 1:1 auth check
→ resolver → response (avg: ~16ms)
→ roci: async log analysis
SOC: exact device on any detection
Intelligence layer

RoCi — AI threat intelligence
that breaks the C2 kill chain.

RoCi analyzes per-client DNS query behavior continuously and classifies threats across every authenticated client simultaneously. When it detects a C2 beacon, a DGA pattern, or a tunneling attempt, it pushes a block rule to the synchronous threat feed immediately — cutting the attacker's communication channel before the device can receive a payload.

DGA Detection
High-entropy subdomain entropy scoring identifies domain generation algorithm patterns used in ransomware staging and C2 infrastructure location
C2 Kill Chain
Periodic query timing patterns to novel infrastructure — characteristic of botnet check-ins. Sinkholed before secondary payloads or encryption keys can be delivered
DNS Tunneling
Anomalous TXT record volumes and high-frequency lookups to newly-registered domains indicating active data exfiltration through the DNS channel
MTTR Reduction
1:1 device attribution on every detection — SOC gets exact device, timestamp, and domain. No VPN correlation, no IP guesswork, immediate containment
RoCi never touches a live query. All analysis is asynchronous on the log stream — after responses are already delivered. DNS resolution latency is a hard constraint. AI inference is not. This is an architectural commitment, not a limitation. The ~16ms production average holds regardless of analysis complexity.
roci — behavioral analysis // k7mxr4bqe9yz2pt6w3dh8cf5a
roci> analyze client:k7mxr4bqe9yz2pt6w3dh8cf5a --deep
baseline ......... 2,400 queries/day
today ............ 2,847 — normal range
✓ latency avg .... 15.52ms
✓ phishing blocked 12 today
✓ malware blocked .. 26 today
 
! C2 kill chain detected — 14:32 UTC
query: xk92mf7a3n.cdn-analytics.net
entropy: 4.2 · DGA pattern: confirmed
✗ BLOCKED · block rule pushed to feed
incident #4471 · device: k7mxr4bqe9yz2pt6w3dh8cf5a
device identified: immediate · attribution: 1:1
Data & logging policy

Configurable retention. No surveillance. No third-party sharing.

Enterprise security teams need logs. Nantevo gives you control over exactly what is retained, for how long, and where — without your data ever being used for anything other than your own security operations.

Full query telemetry — logged by default
Timestamp, authenticated client ID, queried domain, response code, resolution latency, and threat classification are logged for every query. The domain is essential — it powers blocked event lists, RoCi's DGA entropy scoring, per-client behavioral baselines, and incident forensics. Retention window is configurable per policy.
Standard telemetry · configurable retention
Source IP — not retained
Client IP addresses are used transiently for routing and rate limiting only. They are not written to telemetry records. On-premise deployments keep all query data within your network boundary — nothing crosses your perimeter to Nantevo servers.
Not retained · on-premise fully local
Third-party sharing — never
Your DNS telemetry is never shared with, sold to, or accessible by any third party for any purpose. Not for advertising, profiling, or threat intelligence aggregation. It belongs to your organization and is used exclusively for delivering and securing the service you've contracted for.
Zero data sharing · zero surveillance

Compliance & framework alignment

Federal guidance
NSA / CISA PDNS
Aligned with NSA and CISA's joint advisory explicitly recommending Protective DNS to counter malware's pervasive use of DNS for command and control
NIST SP 800-207
Zero Trust Architecture
Every request authenticated, no network implicitly trusted. NIST SP 800-81r3 explicitly identifies the DNS service as a Zero Trust policy enforcement point
NIST SP 800-81r3 · 2026
Secure DNS Deployment
NIST's Secure DNS Deployment Guide (final, 2026) recommends encrypted DNS transport for maintaining resolution integrity. Nantevo enforces RFC 8484 DoH across all enrolled devices
Defense in Depth
Layered Security Model
Three independent security layers: TLS transport encryption, identity-aware proxy authentication at the edge, and automated threat intelligence filtering — each independently effective

Where Nantevo is today

Nantevo has run in continuous production since October 2023 — the sole DNS resolver for a live fleet of real devices across every platform we support. Every metric on this site comes from that deployment, not a lab benchmark.

— 2.5 years of operational history

Enterprise deployment is new territory for the platform, and we say so plainly. Design partners get 50% pricing for 24 months, direct access to the founder, and real influence on the roadmap.

— Design partner program, now accepting

We publish our live component status, our production telemetry, and our incidents — including upstream CDN events — where anyone can check them. Trust should be verifiable, not asserted.

— Live status at nantevo.com/status

Reliability

Production-proven. Not a promise — a record.

Two and a half years of continuous operation across geographically distributed infrastructure. Production telemetry plus live component status from the same platform your organization will run on.

Zero
User-reported service interruptions beyond known CDN events
SELF-REPORTED · SINCE OCTOBER 2023
~16ms
Median production query response — measured over 2.5 years
PRODUCTION TELEMETRY · P50 · GoAccess dashboard
Global
Distributed resolver infrastructure — 32-location expansion roadmap
CLOUD · HYBRID · ON-PREMISE
Live component statusFull status page →
Checking live status… if this doesn't load, see nantevo.com/status.

See Nantevo authenticate a fleet
in under 60 seconds.

Live demo. Your devices. No software installed before, during, or after.