Architects building toward NIST SP 800-207 maturity rarely treat name resolution as a policy decision point. New research from the Cloud Security Alliance says they should.

The CSA Zero Trust working group published “Integrating DNS and SDP: Enhanced Zero Trust Policy Enforcement 2.0”, proposing an architectural pattern it calls “Secure Multi-Step DoH.” The pattern requires identity, device posture, and context to be evaluated before a protected domain name resolves to an IP address. CSA frames this as extending SDP‘s “authenticate-before-connect” principle into “authenticate-before-resolve.”

The practical shift is where enforcement happens. Under this model, resolution itself becomes a PDP/PEP function, so an unauthorized identity or device can be denied service discovery before any SDP or ZTNA session is attempted. CSA is explicit that resolving a name does not grant access: connection-time controls must still independently verify and govern the session.

This is version 2.0 of CSA’s 2022 paper, which concentrated on domain filtering and query logging. The update moves the emphasis to pre-resolution authorization and adds discussion of Network-Infrastructure Hiding Protocol, ZTNA, SASE integration, centralized logging, private resolution, and phased migration.

For federal and enterprise teams, the takeaway is a documented gap to close. If DNS sits outside your Identity, Credential, and Access Management (ICAM) and microsegmentation design, this work gives a standards-aligned, vendor-neutral reference for architecture reviews and RFPs.

One caveat: CSA acknowledges the paper offers no quantified performance, cost, or efficacy data. Treat it as design guidance to pressure-test, not a validated deployment benchmark.

Source: Cloud Security Alliance