https://community.cisco.com/t5/cloud-security/umbrella-questions/m-p/4731262#M1606 <P>Assume a customer is running Umbrella VA's on premise. <BR /><BR />Question 1: If the DNS query is for a host outside of the organization the VA's forward the query to Umbrella DNS servers using DNSCrypt. Assuming the Umbrella DNS servers don't have the answer do they act as recursive DNS resolvers and thus iteratively query the root, TLD, and authoritative DNS servers and then return the answer to the customer? I assume the VA's do NOT act as the recursive resolvers.</P> <P>Question 2: If the first answer to the question above is the Umbrella DNS servers do in fact act as recursive resolvers, do they use DNSSec when forwarding queries to other DNS servers (root, TLD, etc)?</P> Thu, 01 Dec 2022 22:04:09 GMT PatrickCavell85782 2022-12-01T22:04:09Z https://community.cisco.com/t5/cloud-security/umbrella-questions/m-p/4731262#M1606 <P>Assume a customer is running Umbrella VA's on premise. <BR /><BR />Question 1: If the DNS query is for a host outside of the organization the VA's forward the query to Umbrella DNS servers using DNSCrypt. Assuming the Umbrella DNS servers don't have the answer do they act as recursive DNS resolvers and thus iteratively query the root, TLD, and authoritative DNS servers and then return the answer to the customer? I assume the VA's do NOT act as the recursive resolvers.</P> <P>Question 2: If the first answer to the question above is the Umbrella DNS servers do in fact act as recursive resolvers, do they use DNSSec when forwarding queries to other DNS servers (root, TLD, etc)?</P> Thu, 01 Dec 2022 22:04:09 GMT https://community.cisco.com/t5/cloud-security/umbrella-questions/m-p/4731262#M1606 PatrickCavell85782 2022-12-01T22:04:09Z https://community.cisco.com/t5/cloud-security/umbrella-questions/m-p/4731274#M1607 Hi Patrick,<BR /><BR />The answer to both your question is Yes.<BR />Question 1: VA acts as a forwarder only, and Umbrella DNS acts as recursive DNS resolver.<BR />Question 2: Yes, Umbrella DNS acts as fully RFC compliant security aware resolvers by performing DNSSEC validation on queries to authoritative nameservers for signed zones<BR /><BR />Hope that helps.<BR /> Thu, 01 Dec 2022 22:33:37 GMT https://community.cisco.com/t5/cloud-security/umbrella-questions/m-p/4731274#M1607 Jennifer Halim 2022-12-01T22:33:37Z https://community.cisco.com/t5/cloud-security/umbrella-questions/m-p/4731322#M1608 <P>Thanks Jennifer. That was very helpful.</P> Fri, 02 Dec 2022 02:00:18 GMT https://community.cisco.com/t5/cloud-security/umbrella-questions/m-p/4731322#M1608 PatrickCavell85782 2022-12-02T02:00:18Z