Cleartext DNS is DNS traffic sent without encryption or authentication between a client and a resolver. The queries and responses are readable on the network, so observers can see requested domain names and potentially tamper with answers unless the transport is protected by DNS over HTTPS, DNS over TLS, or a similar secure channel.
How Cleartext DNS Works
Cleartext DNS is the traditional form of name resolution, where a client sends queries to a resolver without encrypting the transport or authenticating the messages. That makes the protocol simple and broadly compatible, but it also means the network path can observe the request and the response in transit.
Because DNS is a foundational lookup service, cleartext transport affects ordinary browsing, application calls, and endpoint software alike. The security issue is not that DNS is inherently malformed, but that the channel leaves name-resolution data exposed to passive monitoring and active manipulation unless a protected transport is used.
What Information Cleartext DNS Exposes
Even when the eventual connection to a site or service is encrypted, cleartext DNS can still reveal the domain name being requested. That can disclose business relationships, internal service names, user behaviour, and the timing of access patterns. In some environments, DNS visibility can also help an observer map infrastructure and infer which services or vendors are in use.
Exposure is especially relevant on untrusted networks, shared infrastructures, or paths where intermediaries can inspect traffic. The privacy impact is often broader than users expect because DNS requests may precede every connection attempt and can therefore create a reliable record of interest even when the content itself remains protected.
Tampering, Spoofing, and Trust Boundaries
Because cleartext DNS lacks transport protection, a hostile or compromised network device may be able to alter responses or redirect a client toward a different destination. That can support phishing, traffic interception, malware delivery, or outage-like behaviour that is difficult for users to distinguish from a genuine resolution failure.
The key trust boundary is the resolver path itself. If the client cannot verify that the response came from the expected resolver and arrived unchanged, then DNS becomes a weak point in the chain of trust that underpins almost every Internet-facing application.
Why Secure DNS Transports Matter
DNS over HTTPS, DNS over TLS, and similar secure transports aim to protect DNS queries in transit by adding confidentiality and integrity to the exchange. They reduce passive observation and make opportunistic tampering much harder, although they do not by themselves solve every naming or resolver-trust problem.
Choosing a secure transport is therefore a protection decision, not a cosmetic protocol preference. It helps preserve the confidentiality of requested names and the integrity of the answers, while still leaving organisations to decide which resolver they trust, how they log DNS activity, and how they control endpoint behaviour.
Risk and Threat Considerations
Cleartext DNS creates a dual risk, observers can learn where users and systems are trying to connect, and attackers on the path can sometimes influence where those connections go. That makes it a useful target for surveillance, censorship, phishing support, and network-level interception.
Failure mechanism: The protocol exposes queries and responses in transit, so any actor with network visibility may passively collect destination intelligence or actively forge, replay, or redirect answers when transport protection is absent.
Impact: Exposed DNS can weaken privacy, aid reconnaissance, and enable misdirection to malicious infrastructure, especially on networks where clients trust whichever resolver answers first.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-8 — Transmission Confidentiality and Integrity | Cleartext DNS lacks protected transport, so this control directly addresses DNS traffic protection in transit. |
| SC-23 — Session Authenticity | DNS response trust depends on authentic, unaltered exchanges across the network path. | |
| SI-4 — System Monitoring | Organizations need visibility into DNS transport choice and suspicious resolution behaviour. | |
| Recommendation — Protect DNS traffic in transit to preserve confidentiality and integrity of queries and responses. Verify that network exchanges are authentic so resolvers cannot be trivially spoofed in transit. Monitor DNS activity for anomalies that indicate interception, redirection, or policy drift. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | DNS visibility and resolver events support detection and review of suspicious name-resolution patterns. |
| Recommendation — Collect and review DNS-related logs to spot unusual resolution patterns or tampering indicators. | ||
| NIST Zero Trust (SP 800-207) | SC-8 — Transmission Confidentiality and Integrity | Zero Trust requires protected communications between clients and resolvers rather than implicit trust in the path. |
| Recommendation — Use protected DNS channels so name resolution is not exposed to untrusted network intermediaries. | ||
Practitioner Guidance
Why practitioners should care: Treat DNS transport choice as part of the control plane for endpoint privacy and trust. If resolvers, enterprise policy, or endpoint settings still allow cleartext DNS where stronger options are available, the environment may be leaking metadata that security teams expect to remain hidden.
What to watch for: Pay attention to mixed DNS behaviour across browsers, operating systems, VPNs, and security tools, because partial deployment can leave some traffic protected and some traffic exposed. The practical question is not just whether secure DNS exists, but whether it is consistently enforced where the organisation expects it.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org