[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFFGCNQATHTJWC3ZWF1V30":3,"skill-same:01M6AFFGCNQATHTJWC3ZWF1V30":119},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":67,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6AFFGCNQATHTJWC3ZWF1V30","implementing-zero-trust-dns-with-nextdns",null,"Configure NextDNS as an encrypted (DoH\u002FDoT) zero trust DNS resolver that blocks malicious, phishing, and cryptojacking domains via real-time threat intelligence, detects DNS rebinding and CNAME cloaking, and enforces organizational DNS policy across endpoints. Use when deploying DNS-layer threat blocking and acceptable-use enforcement, or when extending zero trust controls (including Windows 11 Zero Trust DNS) to the DNS resolution path.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-dns-with-nextdns\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"implementing zero trust dns with nextdns","dns","ZeRO","tls","encrypted-dns","dns-filtering","threat-blocking","dns-over-tls","dns-over-https","nextdns","real-time","t1078","malicious","zero-trust","pr","windows","architecture","threat intelligence","cybersecurity","policy","2026-11-10 10:12:30",false,"---\nname: implementing-zero-trust-dns-with-nextdns\ndescription: Configure NextDNS as an encrypted (DoH\u002FDoT) zero trust DNS resolver that blocks malicious, phishing, and cryptojacking domains via real-time threat intelligence, detects DNS rebinding and CNAME cloaking, and enforces organizational DNS policy across endpoints. Use when deploying DNS-layer threat blocking and acceptable-use enforcement, or when extending zero trust controls (including Windows 11 Zero Trust DNS) to the DNS resolution path.\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- zero-trust\n- dns\n- nextdns\n- dns-over-https\n- dns-over-tls\n- threat-blocking\n- dns-filtering\n- privacy\n- encrypted-dns\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1573\n- T1486\n---\n\n# Implementing Zero Trust DNS with NextDNS\n\n## Overview\n\nNextDNS is a cloud-based DNS resolver that provides encrypted DNS resolution (DNS-over-HTTPS and DNS-over-TLS), real-time threat intelligence blocking, ad and tracker filtering, and granular DNS policy enforcement. In a zero trust architecture, DNS is a critical control point -- every network connection begins with a DNS query, making DNS filtering an effective layer for blocking malicious domains, preventing data exfiltration via DNS tunneling, enforcing acceptable use policies, and gaining visibility into all network communications. NextDNS processes queries using threat intelligence feeds containing millions of malicious domains updated in real-time, blocks cryptojacking and phishing domains, detects DNS rebinding attacks, and supports CNAME cloaking protection. For enterprise environments, Microsoft's Zero Trust DNS (ZTDNS) feature on Windows 11 extends this concept by enforcing that endpoints can only resolve domains through approved protected DNS servers.\n\n\n## When to Use\n\n- When deploying or configuring implementing zero trust dns with nextdns capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- NextDNS account (free tier: 300,000 queries\u002Fmonth; Pro: unlimited)\n- Network devices supporting DoH or DoT configuration\n- Administrative access to endpoint DNS settings\n- Understanding of DNS protocol and resolution chain\n- Familiarity with organizational acceptable use policies\n\n## Architecture\n\n```\n    Endpoint Device\n         |\n    DNS Query (Encrypted)\n         |\n    +----+----+\n    |  DoH\u002FDoT |  (DNS-over-HTTPS or DNS-over-TLS)\n    |  Tunnel  |\n    +----+----+\n         |\n    +----+----+\n    | NextDNS  |\n    | Resolver |\n    +----+----+\n         |\n    +----+----+------+--------+\n    |         |       |        |\n  Threat   Ad\u002FTracker Privacy  Parental\n  Intel    Blocklists Controls Controls\n  Check    Check      Check    Check\n    |         |       |        |\n    +----+----+------+--------+\n         |\n    ALLOW or BLOCK\n         |\n    Response to Endpoint\n```\n\n## Configuration Setup\n\n### NextDNS Profile Configuration\n\n```\nDashboard: https:\u002F\u002Fmy.nextdns.io\n\nConfiguration ID: abc123 (unique per profile)\n\nEndpoints:\n  DNS-over-HTTPS: https:\u002F\u002Fdns.nextdns.io\u002Fabc123\n  DNS-over-TLS:   abc123.dns.nextdns.io\n  DNS-over-QUIC:  quic:\u002F\u002Fabc123.dns.nextdns.io\n  IPv4:           45.90.28.x, 45.90.30.x (linked to config)\n  IPv6:           2a07:a8c0::xx, 2a07:a8c1::xx\n```\n\n### Security Settings\n\n```\nSecurity Tab Configuration:\n  [x] Threat Intelligence Feeds - Block domains from curated threat feeds\n  [x] AI-Driven Threat Detection - Machine learning-based detection\n  [x] Google Safe Browsing - Cross-reference with Google's threat database\n  [x] Cryptojacking Protection - Block crypto mining domains\n  [x] DNS Rebinding Protection - Prevent DNS rebinding attacks\n  [x] IDN Homograph Attacks - Block internationalized domain name attacks\n  [x] Typosquatting Protection - Block common typosquatting domains\n  [x] DGA Protection - Block domain generation algorithm domains\n  [x] NRD (Newly Registered Domains) - Block domains \u003C 30 days old\n  [x] DDNS (Dynamic DNS) - Block dynamic DNS services\n  [x] Parked Domains - Block parked\u002Funused domains\n  [x] CSAM - Block child sexual abuse material domains\n```\n\n### Privacy Settings\n\n```\nPrivacy Tab Configuration:\n  Blocklists:\n    [x] NextDNS Ads & Trackers Blocklist\n    [x] OISD (Full)\n    [x] EasyPrivacy\n    [x] AdGuard DNS Filter\n\n  Native Tracking Protection:\n    [x] Block Windows telemetry\n    [x] Block Apple telemetry\n    [x] Block Samsung telemetry\n    [x] Block Xiaomi telemetry\n    [x] Block Huawei telemetry\n    [x] Block Roku telemetry\n    [x] Block Sonos telemetry\n\n  [x] Block Disguised Third-Party Trackers (CNAME cloaking)\n  [x] Allow Affiliate & Tracking Links (optional, for business)\n```\n\n### Allowlist and Denylist\n\n```\nAllowlist (domains that bypass all blocking):\n  - login.microsoftonline.com\n  - graph.microsoft.com\n  - *.company.com\n\nDenylist (always blocked regardless of other settings):\n  - known-malicious-domain.com\n  - unauthorized-cloud-storage.com\n  - personal-email-provider.com  (if policy requires)\n```\n\n## Endpoint Deployment\n\n### Linux (systemd-resolved)\n\n```bash\n# Configure DNS-over-TLS with systemd-resolved\nsudo tee \u002Fetc\u002Fsystemd\u002Fresolved.conf \u003C\u003C 'EOF'\n[Resolve]\nDNS=45.90.28.x#abc123.dns.nextdns.io\nDNS=45.90.30.x#abc123.dns.nextdns.io\nDNS=2a07:a8c0::xx#abc123.dns.nextdns.io\nDNS=2a07:a8c1::xx#abc123.dns.nextdns.io\nDNSOverTLS=yes\nDomains=~.\nEOF\n\nsudo systemctl restart systemd-resolved\n\n# Verify\nresolvectl status\nresolvectl query example.com\n```\n\n### Linux (NextDNS CLI)\n\n```bash\n# Install NextDNS CLI\nsh -c 'sh -e $(curl -sL https:\u002F\u002Fnextdns.io\u002Finstall)'\n\n# Configure with your profile\nsudo nextdns install \\\n  -config abc123 \\\n  -report-client-info \\\n  -auto-activate\n\n# Verify\nnextdns status\nnextdns log\n```\n\n### macOS\n\n```bash\n# Install via Homebrew\nbrew install nextdns\u002Ftap\u002Fnextdns\n\n# Configure\nsudo nextdns install \\\n  -config abc123 \\\n  -report-client-info\n\n# Or configure via System Settings > Network > DNS\n# Add DNS-over-HTTPS: https:\u002F\u002Fdns.nextdns.io\u002Fabc123\n```\n\n### Windows\n\n```powershell\n# Install NextDNS CLI for Windows\n# Download from: https:\u002F\u002Fnextdns.io\u002Fdownload\u002Fwindows\n\n# Or configure DoH natively (Windows 11)\n# Settings > Network & Internet > Ethernet\u002FWi-Fi > DNS\n# Preferred DNS: 45.90.28.x\n# DNS over HTTPS: On (Manual template)\n# DoH Template: https:\u002F\u002Fdns.nextdns.io\u002Fabc123\n\n# PowerShell: Configure DoH\nSet-DnsClientDohServerAddress -ServerAddress \"45.90.28.x\" `\n  -DohTemplate \"https:\u002F\u002Fdns.nextdns.io\u002Fabc123\" `\n  -AllowFallbackToUdp $false `\n  -AutoUpgrade $true\n```\n\n### Router-Level Configuration\n\n```\n# Most routers support custom DNS servers\n# For DoH\u002FDoT-capable routers (pfSense, OPNsense, OpenWrt):\n\n# pfSense DNS Resolver (Unbound):\n# Services > DNS Resolver > Custom Options:\nserver:\n  forward-zone:\n    name: \".\"\n    forward-tls-upstream: yes\n    forward-addr: 45.90.28.x@853#abc123.dns.nextdns.io\n    forward-addr: 45.90.30.x@853#abc123.dns.nextdns.io\n\n# OpenWrt (using https-dns-proxy):\nopkg update && opkg install https-dns-proxy\nuci set https-dns-proxy.default.resolver_url='https:\u002F\u002Fdns.nextdns.io\u002Fabc123'\nuci commit https-dns-proxy\n\u002Fetc\u002Finit.d\u002Fhttps-dns-proxy restart\n```\n\n### Mobile Devices\n\n```\niOS:\n  Install NextDNS app from App Store\n  Or: Settings > General > VPN & Device Management\n  Install NextDNS configuration profile\n\nAndroid:\n  Settings > Network > Private DNS\n  DNS Provider: abc123.dns.nextdns.io\n\n  Or: Install NextDNS app from Play Store\n```\n\n## Microsoft Zero Trust DNS (Windows 11)\n\nFor enterprise Windows environments, Microsoft's ZTDNS enforces that endpoints can only communicate with domains resolved through approved DNS servers.\n\n```powershell\n# Enable ZTDNS (Windows 11 23H2+)\n# Requires Windows Defender Firewall in enforcing mode\n\n# Configure Protected DNS Servers via Group Policy:\n# Computer Configuration > Administrative Templates > Network > DNS Client\n# > Configure DNS over HTTPS (DoH) name resolution\n# > Protected DNS servers: https:\u002F\u002Fdns.nextdns.io\u002Fabc123\n\n# Windows Firewall blocks all traffic to domains not resolved\n# through the protected DNS server\n```\n\n## Monitoring and Analytics\n\n### Log Analysis\n\n```\nNextDNS Analytics Dashboard provides:\n  - Total queries over time\n  - Blocked queries by category\n  - Top domains (allowed and blocked)\n  - Top blocked reasons (threat, ad, tracker)\n  - Device-level breakdown\n  - Geographic query distribution\n\nLog Settings:\n  Retention: 1 hour \u002F 6 hours \u002F 1 day \u002F 1 week \u002F 1 month \u002F 3 months \u002F 1 year \u002F 2 years\n  Storage Location: US \u002F EU \u002F UK \u002F Switzerland\n  Logging: [ ] Enable \u002F [ ] Disable\n```\n\n### API Integration\n\n```bash\n# NextDNS API for automated monitoring\n# Get analytics data\ncurl -H \"X-Api-Key: your-api-key\" \\\n  \"https:\u002F\u002Fapi.nextdns.io\u002Fprofiles\u002Fabc123\u002Fanalytics\u002Fdomains?from=-24h\"\n\n# Get blocked domains\ncurl -H \"X-Api-Key: your-api-key\" \\\n  \"https:\u002F\u002Fapi.nextdns.io\u002Fprofiles\u002Fabc123\u002Fanalytics\u002Fdomains?from=-24h&status=blocked\"\n\n# Export logs for SIEM integration\ncurl -H \"X-Api-Key: your-api-key\" \\\n  \"https:\u002F\u002Fapi.nextdns.io\u002Fprofiles\u002Fabc123\u002Flogs?from=-1h\" \\\n  | jq '.data[] | select(.status == \"blocked\")'\n```\n\n## Zero Trust DNS Policy Framework\n\n### Policy Tiers\n\n```\nTier 1 - Security (Mandatory for all):\n  - Threat intelligence blocking\n  - Cryptojacking protection\n  - DNS rebinding protection\n  - DGA detection\n  - NRD blocking (\u003C 30 days)\n\nTier 2 - Privacy (Recommended):\n  - Tracker blocking\n  - Native telemetry blocking\n  - CNAME cloaking protection\n\nTier 3 - Compliance (Organization-specific):\n  - Category-based blocking\n  - Custom allowlists\u002Fdenylists\n  - Time-based access policies\n  - Log retention per regulatory requirements\n```\n\n## Security Best Practices\n\n1. **Enforce encrypted DNS**: Block plaintext DNS (port 53 UDP\u002FTCP) at the firewall\n2. **Use NextDNS CLI on endpoints**: Ensures per-device identification and logging\n3. **Enable NRD blocking**: Newly registered domains are overwhelmingly malicious\n4. **Block DNS-over-HTTPS bypass**: Ensure browsers use system DNS, not built-in DoH\n5. **Review blocklists quarterly**: Remove false positives, add organizational blocks\n6. **Enable CNAME cloaking protection**: Prevents tracker evasion via CNAME records\n7. **Set appropriate log retention**: Balance privacy with forensic needs (90 days recommended)\n8. **Monitor for DNS tunneling**: Watch for unusual query patterns and high entropy domains\n9. **Deploy at router level**: Catches all devices including IoT and unmanaged endpoints\n10. **Combine with endpoint DNS**: Defense in depth with both router and per-device filtering\n\n## References\n\n- [NextDNS Documentation](https:\u002F\u002Fnextdns.io\u002F)\n- [NextDNS Configuration Guide (GitHub)](https:\u002F\u002Fgithub.com\u002Fyokoffing\u002FNextDNS-Config)\n- [Microsoft Zero Trust DNS](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Foperating-system-security\u002Fnetwork-security\u002Fzero-trust-dns\u002F)\n- [NIST SP 800-81-2: Secure DNS Deployment Guide](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-81\u002F2\u002Ffinal)\n- [RFC 8484: DNS Queries over HTTPS (DoH)](https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc8484)\n- [RFC 7858: DNS over TLS (DoT)](https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc7858)\n","# Implementing Zero Trust DNS with NextDNS\n\n## Overview\n\nNextDNS is a cloud-based DNS resolver that provides encrypted DNS resolution (DNS-over-HTTPS and DNS-over-TLS), real-time threat intelligence blocking, ad and tracker filtering, and granular DNS policy enforcement. In a zero trust architecture, DNS is a critical control point -- every network connection begins with a DNS query, making DNS filtering an effective layer for blocking malicious domains, preventing data exfiltration via DNS tunneling, enforcing acceptable use policies, and gaining visibility into all network communications. NextDNS processes queries using threat intelligence feeds containing millions of malicious domains updated in real-time, blocks cryptojacking and phishing domains, detects DNS rebinding attacks, and supports CNAME cloaking protection. For enterprise environments, Microsoft's Zero Trust DNS (ZTDNS) feature on Windows 11 extends this concept by enforcing that endpoints can only resolve domains through approved protected DNS servers.\n\n\n## When to Use\n\n- When deploying or configuring implementing zero trust dns with nextdns capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- NextDNS account (free tier: 300,000 queries\u002Fmonth; Pro: unlimited)\n- Network devices supporting DoH or DoT configuration\n- Administrative access to endpoint DNS settings\n- Understanding of DNS protocol and resolution chain\n- Familiarity with organizational acceptable use policies\n\n## Architecture\n\n```\n    Endpoint Device\n         |\n    DNS Query (Encrypted)\n         |\n    +----+----+\n    |  DoH\u002FDoT |  (DNS-over-HTTPS or DNS-over-TLS)\n    |  Tunnel  |\n    +----+----+\n         |\n    +----+----+\n    | NextDNS  |\n    | Resolver |\n    +----+----+\n         |\n    +----+----+------+--------+\n    |         |       |        |\n  Threat   Ad\u002FTracker Privacy  Parental\n  Intel    Blocklists Controls Controls\n  Check    Check      Check    Check\n    |         |       |        |\n    +----+----+------+--------+\n         |\n    ALLOW or BLOCK\n         |\n    Response to Endpoint\n```\n\n## Configuration Setup\n\n### NextDNS Profile Configuration\n\n```\nDashboard: https:\u002F\u002Fmy.nextdns.io\n\nConfiguration ID: abc123 (unique per profile)\n\nEndpoints:\n  DNS-over-HTTPS: https:\u002F\u002Fdns.nextdns.io\u002Fabc123\n  DNS-over-TLS:   abc123.dns.nextdns.io\n  DNS-over-QUIC:  quic:\u002F\u002Fabc123.dns.nextdns.io\n  IPv4:           45.90.28.x, 45.90.30.x (linked to config)\n  IPv6:           2a07:a8c0::xx, 2a07:a8c1::xx\n```\n\n### Security Settings\n\n```\nSecurity Tab Configuration:\n  [x] Threat Intelligence Feeds - Block domains from curated threat feeds\n  [x] AI-Driven Threat Detection - Machine learning-based detection\n  [x] Google Safe Browsing - Cross-reference with Google's threat database\n  [x] Cryptojacking Protection - Block crypto mining domains\n  [x] DNS Rebinding Protection - Prevent DNS rebinding attacks\n  [x] IDN Homograph Attacks - Block internationalized domain name attacks\n  [x] Typosquatting Protection - Block common typosquatting domains\n  [x] DGA Protection - Block domain generation algorithm domains\n  [x] NRD (Newly Registered Domains) - Block domains \u003C 30 days old\n  [x] DDNS (Dynamic DNS) - Block dynamic DNS services\n  [x] Parked Domains - Block parked\u002Funused domains\n  [x] CSAM - Block child sexual abuse material domains\n```\n\n### Privacy Settings\n\n```\nPrivacy Tab Configuration:\n  Blocklists:\n    [x] NextDNS Ads & Trackers Blocklist\n    [x] OISD (Full)\n    [x] EasyPrivacy\n    [x] AdGuard DNS Filter\n\n  Native Tracking Protection:\n    [x] Block Windows telemetry\n    [x] Block Apple telemetry\n    [x] Block Samsung telemetry\n    [x] Block Xiaomi telemetry\n    [x] Block Huawei telemetry\n    [x] Block Roku telemetry\n    [x] Block Sonos telemetry\n\n  [x] Block Disguised Third-Party Trackers (CNAME cloaking)\n  [x] Allow Affiliate & Tracking Links (optional, for business)\n```\n\n### Allowlist and Denylist\n\n```\nAllowlist (domains that bypass all blocking):\n  - login.microsoftonline.com\n  - graph.microsoft.com\n  - *.company.com\n\nDenylist (always blocked regardless of other settings):\n  - known-malicious-domain.com\n  - unauthorized-cloud-storage.com\n  - personal-email-provider.com  (if policy requires)\n```\n\n## Endpoint Deployment\n\n### Linux (systemd-resolved)\n\n```bash\n# Configure DNS-over-TLS with systemd-resolved\nsudo tee \u002Fetc\u002Fsystemd\u002Fresolved.conf \u003C\u003C 'EOF'\n[Resolve]\nDNS=45.90.28.x#abc123.dns.nextdns.io\nDNS=45.90.30.x#abc123.dns.nextdns.io\nDNS=2a07:a8c0::xx#abc123.dns.nextdns.io\nDNS=2a07:a8c1::xx#abc123.dns.nextdns.io\nDNSOverTLS=yes\nDomains=~.\nEOF\n\nsudo systemctl restart systemd-resolved\n\n# Verify\nresolvectl status\nresolvectl query example.com\n```\n\n### Linux (NextDNS CLI)\n\n```bash\n# Install NextDNS CLI\nsh -c 'sh -e $(curl -sL https:\u002F\u002Fnextdns.io\u002Finstall)'\n\n# Configure with your profile\nsudo nextdns install \\\n  -config abc123 \\\n  -report-client-info \\\n  -auto-activate\n\n# Verify\nnextdns status\nnextdns log\n```\n\n### macOS\n\n```bash\n# Install via Homebrew\nbrew install nextdns\u002Ftap\u002Fnextdns\n\n# Configure\nsudo nextdns install \\\n  -config abc123 \\\n  -report-client-info\n\n# Or configure via System Settings > Network > DNS\n# Add DNS-over-HTTPS: https:\u002F\u002Fdns.nextdns.io\u002Fabc123\n```\n\n### Windows\n\n```powershell\n# Install NextDNS CLI for Windows\n# Download from: https:\u002F\u002Fnextdns.io\u002Fdownload\u002Fwindows\n\n# Or configure DoH natively (Windows 11)\n# Settings > Network & Internet > Ethernet\u002FWi-Fi > DNS\n# Preferred DNS: 45.90.28.x\n# DNS over HTTPS: On (Manual template)\n# DoH Template: https:\u002F\u002Fdns.nextdns.io\u002Fabc123\n\n# PowerShell: Configure DoH\nSet-DnsClientDohServerAddress -ServerAddress \"45.90.28.x\" `\n  -DohTemplate \"https:\u002F\u002Fdns.nextdns.io\u002Fabc123\" `\n  -AllowFallbackToUdp $false `\n  -AutoUpgrade $true\n```\n\n### Router-Level Configuration\n\n```\n# Most routers support custom DNS servers\n# For DoH\u002FDoT-capable routers (pfSense, OPNsense, OpenWrt):\n\n# pfSense DNS Resolver (Unbound):\n# Services > DNS Resolver > Custom Options:\nserver:\n  forward-zone:\n    name: \".\"\n    forward-tls-upstream: yes\n    forward-addr: 45.90.28.x@853#abc123.dns.nextdns.io\n    forward-addr: 45.90.30.x@853#abc123.dns.nextdns.io\n\n# OpenWrt (using https-dns-proxy):\nopkg update && opkg install https-dns-proxy\nuci set https-dns-proxy.default.resolver_url='https:\u002F\u002Fdns.nextdns.io\u002Fabc123'\nuci commit https-dns-proxy\n\u002Fetc\u002Finit.d\u002Fhttps-dns-proxy restart\n```\n\n### Mobile Devices\n\n```\niOS:\n  Install NextDNS app from App Store\n  Or: Settings > General > VPN & Device Management\n  Install NextDNS configuration profile\n\nAndroid:\n  Settings > Network > Private DNS\n  DNS Provider: abc123.dns.nextdns.io\n\n  Or: Install NextDNS app from Play Store\n```\n\n## Microsoft Zero Trust DNS (Windows 11)\n\nFor enterprise Windows environments, Microsoft's ZTDNS enforces that endpoints can only communicate with domains resolved through approved DNS servers.\n\n```powershell\n# Enable ZTDNS (Windows 11 23H2+)\n# Requires Windows Defender Firewall in enforcing mode\n\n# Configure Protected DNS Servers via Group Policy:\n# Computer Configuration > Administrative Templates > Network > DNS Client\n# > Configure DNS over HTTPS (DoH) name resolution\n# > Protected DNS servers: https:\u002F\u002Fdns.nextdns.io\u002Fabc123\n\n# Windows Firewall blocks all traffic to domains not resolved\n# through the protected DNS server\n```\n\n## Monitoring and Analytics\n\n### Log Analysis\n\n```\nNextDNS Analytics Dashboard provides:\n  - Total queries over time\n  - Blocked queries by category\n  - Top domains (allowed and blocked)\n  - Top blocked reasons (threat, ad, tracker)\n  - Device-level breakdown\n  - Geographic query distribution\n\nLog Settings:\n  Retention: 1 hour \u002F 6 hours \u002F 1 day \u002F 1 week \u002F 1 month \u002F 3 months \u002F 1 year \u002F 2 years\n  Storage Location: US \u002F EU \u002F UK \u002F Switzerland\n  Logging: [ ] Enable \u002F [ ] Disable\n```\n\n### API Integration\n\n```bash\n# NextDNS API for automated monitoring\n# Get analytics data\ncurl -H \"X-Api-Key: your-api-key\" \\\n  \"https:\u002F\u002Fapi.nextdns.io\u002Fprofiles\u002Fabc123\u002Fanalytics\u002Fdomains?from=-24h\"\n\n# Get blocked domains\ncurl -H \"X-Api-Key: your-api-key\" \\\n  \"https:\u002F\u002Fapi.nextdns.io\u002Fprofiles\u002Fabc123\u002Fanalytics\u002Fdomains?from=-24h&status=blocked\"\n\n# Export logs for SIEM integration\ncurl -H \"X-Api-Key: your-api-key\" \\\n  \"https:\u002F\u002Fapi.nextdns.io\u002Fprofiles\u002Fabc123\u002Flogs?from=-1h\" \\\n  | jq '.data[] | select(.status == \"blocked\")'\n```\n\n## Zero Trust DNS Policy Framework\n\n### Policy Tiers\n\n```\nTier 1 - Security (Mandatory for all):\n  - Threat intelligence blocking\n  - Cryptojacking protection\n  - DNS rebinding protection\n  - DGA detection\n  - NRD blocking (\u003C 30 days)\n\nTier 2 - Privacy (Recommended):\n  - Tracker blocking\n  - Native telemetry blocking\n  - CNAME cloaking protection\n\nTier 3 - Compliance (Organization-specific):\n  - Category-based blocking\n  - Custom allowlists\u002Fdenylists\n  - Time-based access policies\n  - Log retention per regulatory requirements\n```\n\n## Security Best Practices\n\n1. **Enforce encrypted DNS**: Block plaintext DNS (port 53 UDP\u002FTCP) at the firewall\n2. **Use NextDNS CLI on endpoints**: Ensures per-device identification and logging\n3. **Enable NRD blocking**: Newly registered domains are overwhelmingly malicious\n4. **Block DNS-over-HTTPS bypass**: Ensure browsers use system DNS, not built-in DoH\n5. **Review blocklists quarterly**: Remove false positives, add organizational blocks\n6. **Enable CNAME cloaking protection**: Prevents tracker evasion via CNAME records\n7. **Set appropriate log retention**: Balance privacy with forensic needs (90 days recommended)\n8. **Monitor for DNS tunneling**: Watch for unusual query patterns and high entropy domains\n9. **Deploy at router level**: Catches all devices including IoT and unmanaged endpoints\n10. **Combine with endpoint DNS**: Defense in depth with both router and per-device filtering\n\n## References\n\n- [NextDNS Documentation](https:\u002F\u002Fnextdns.io\u002F)\n- [NextDNS Configuration Guide (GitHub)](https:\u002F\u002Fgithub.com\u002Fyokoffing\u002FNextDNS-Config)\n- [Microsoft Zero Trust DNS](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Foperating-system-security\u002Fnetwork-security\u002Fzero-trust-dns\u002F)\n- [NIST SP 800-81-2: Secure DNS Deployment Guide](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-81\u002F2\u002Ffinal)\n- [RFC 8484: DNS Queries over HTTPS (DoH)](https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc8484)\n- [RFC 7858: DNS over TLS (DoT)](https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc7858)\n",{"name":5,"tags":44,"author":46,"domain":37,"license":15,"version":47,"nist_csf":48,"subdomain":53,"description":7,"mitre_attack":54},[32,20,28,27,26,25,24,45,23],"privacy","mahipal","1.0",[49,50,51,52],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture",[55,56,57,58,59],"T1078","T1190","T1059","T1573","T1486","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-zero-trust-dns-with-nextdns",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-zero-trust-dns-with-nextdns",{"tool":76,"command":77},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-zero-trust-dns-with-nextdns",{"tool":79,"command":80},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-zero-trust-dns-with-nextdns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-dns-with-nextdns\u002FSKILL.md",true,[84,90,95,101,105,109,115],{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"assets\u002Ftemplate.md","ASSET","资产文件",1526,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-dns-with-nextdns\u002Fassets\u002Ftemplate.md",{"path":91,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-dns-with-nextdns\u002FLICENSE",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md","REFERENCE","参考文档",1696,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-dns-with-nextdns\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fstandards.md",1759,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-dns-with-nextdns\u002Freferences\u002Fstandards.md",{"path":106,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fworkflows.md",2462,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-dns-with-nextdns\u002Freferences\u002Fworkflows.md",{"path":110,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"scripts\u002Fagent.py","SCRIPT","脚本",6000,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-dns-with-nextdns\u002Fscripts\u002Fagent.py",{"path":116,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":117,"sourceHtmlUrl":118},"scripts\u002Fprocess.py",9589,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-dns-with-nextdns\u002Fscripts\u002Fprocess.py",[120,150,172,199,224,251],{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":131,"publishedAt":39},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[126],{"categoryNo":127,"categoryName":128,"taxonomyType":129,"taxonomyTypeDesc":130},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[132,133,134,135,136,37,137,138,33,139,140,141,142,143,144,145,146,147,148,149],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":39},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[156],{"categoryNo":127,"categoryName":128,"taxonomyType":129,"taxonomyTypeDesc":130},[158,146,159,160,136,38,37,33,161,21,162,163,164,165,166,167,168,169,170,171],"boot","TPM","validating tpm measured boot attestation","verification","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":182,"publishedAt":39},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[178,181],{"categoryNo":179,"categoryName":180,"taxonomyType":129,"taxonomyTypeDesc":130},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":127,"categoryName":128,"taxonomyType":129,"taxonomyTypeDesc":130},[166,183,184,185,186,37,187,188,161,189,190,191,192,193,194,30,195,196,197,198],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":206,"publishedAt":39},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[205],{"categoryNo":127,"categoryName":128,"taxonomyType":129,"taxonomyTypeDesc":130},[34,207,208,37,209,210,211,212,213,214,215,216,217,218,219,220,163,221,222,223],"kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":228,"categories":229,"keywords":231,"publishedAt":39},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[230],{"categoryNo":127,"categoryName":128,"taxonomyType":129,"taxonomyTypeDesc":130},[232,233,234,37,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":252,"name":253,"nameZh":6,"description":254,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":255,"categories":256,"keywords":258,"publishedAt":39},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[257],{"categoryNo":127,"categoryName":128,"taxonomyType":129,"taxonomyTypeDesc":130},[136,259,37,260,261,262,263,264,265,266,267,30,268,195,269,270,271,272,273,274],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]