Built by someone who ran
the infrastructure first.

The story starts in 2005, not 2024. A young engineer running DNS for the Department of Defense's procurement platform in FreeBSD jails, under a top-secret clearance that required FBI interviews of everyone who had ever known him. That infrastructure, those jails, that discipline around availability and security: the architecture that became Nantevo has roots two decades deep.

A decade later, the same engineer was running DNS for the Adobe Marketing Cloud — the analytics backbone for a significant share of the Fortune 500's web properties. Billions of queries per day across a global anycast network spanning more than two dozen data centers. Latency and availability were not engineering goals. They were business requirements. A slow DNS response meant a delayed page load for millions of users. A failure meant calls from executives.

It was at Adobe that the pattern that defines Nantevo first became visible: a security gap nobody had solved cleanly, a novel solution built in the gaps between meetings, and an industry recognizing it before the builder fully understood what he had made.

HubbleStack was a security visibility platform built at Adobe — real-time file integrity monitoring, CIS benchmark compliance, and osquery fleet telemetry at enterprise scale. The CSO50 award recognized it as innovative thought leadership. Multiple engineers at SaltStack said directly that it saved the company. SaltStack was acquired by VMware for $51 million. The builder of HubbleStack received a good salary and no part of the acquisition. That is not a complaint. It is a fact that clarified something important about the next chapter.

In 2023, QueryGuard launched — not as a lab experiment or a demo environment, but as a real service deployed to real households. Friends and family who volunteered to generate real traffic across real devices: iPhones, iPads, MacBooks, Android phones, Windows laptops, Linux machines, FreeBSD workstations, home routers providing network-wide protection, and every major browser. Each household received a unique endpoint and ClientID — per-client authentication from day one — with dashboard access, customizable filtering rules, and protection telemetry.

The dashboard itself was built with the same care as the resolver: magic link login — no passwords, ever. Charts showing blocked threat categories, bandwidth saved by ad filtering, top detected threats, and even anonymous comparative rankings against other users. A real product experience for real users, built and maintained by one engineer from a van on the road.

That service has run continuously since October 2023 — two and a half years without a service interruption. No user has ever filed a complaint about downtime beyond the known Cloudflare outage events that affected the entire cloud delivery layer. Among twenty years of operating public-facing internet services, this stands as one of the highest availability records achieved.

The van itself runs a Raspberry Pi that acts as a local DNS resolver — lightweight caching and first-line filtering, forwarding all queries upstream to the cloud endpoints. Optimistic caching makes the upstream round trip completely transparent to the user after the initial request. The van is both a test environment and a demonstration of the hybrid deployment model: local intelligence where low latency matters, cloud intelligence where deeper analysis is available.

During those same two years, a master's degree in cybersecurity was completed in four months through competency-based assessment — the capstone paper written on Protective DNS, using the production service as both the design template and the implementation proof. Formal credentials for two decades of informal expertise.

After twenty years of building and operating public-facing internet services, one observation stands above the others: DNS sits at the foundation of every internet interaction a device makes. Every HTTP request, every API call, every application connection begins with a DNS lookup. No other layer in the OSI model provides as broad and consistent a vantage point for security intervention.

An endpoint agent can only see what happens on the device it runs on. A firewall can only see traffic that flows through it. A SIEM sees what other tools choose to send it. DNS sees everything — on every device, through every application, across every network connection — before any of it happens. A threat that is blocked at DNS resolution is a threat that never had the opportunity to deliver a payload, establish a connection, or exfiltrate data.

The incumbent solutions understood this. What they got wrong was the deployment model. Agents create the operational overhead they're supposed to eliminate. Kernel extensions introduce the attack surface they're supposed to prevent. Complex enrollment workflows mean the devices most in need of protection — unmanaged, BYOD, contractor — are the ones least likely to have it.

The authenticated DoH architecture wasn't designed from theory. It came from someone who has managed agent rollouts across enterprise fleets, debugged kernel extension conflicts at 3am, and watched BYOD coverage gaps get exploited in production. The transport-layer credential approach solves the operational problem by removing the operational burden entirely.