Umbrella questions

[PatrickCavell85782]

Assume a customer is running Umbrella VA's on premise.

Question 1: If the DNS query is for a host outside of the organization the VA's forward the query to Umbrella DNS servers using DNSCrypt. Assuming the Umbrella DNS servers don't have the answer do they act as recursive DNS resolvers and thus iteratively query the root, TLD, and authoritative DNS servers and then return the answer to the customer? I assume the VA's do NOT act as the recursive resolvers.

Question 2: If the first answer to the question above is the Umbrella DNS servers do in fact act as recursive resolvers, do they use DNSSec when forwarding queries to other DNS servers (root, TLD, etc)?

[Jennifer Halim · Accepted solution]

Hi Patrick,

The answer to both your question is Yes.
Question 1: VA acts as a forwarder only, and Umbrella DNS acts as recursive DNS resolver.
Question 2: Yes, Umbrella DNS acts as fully RFC compliant security aware resolvers by performing DNSSEC validation on queries to authoritative nameservers for signed zones

Hope that helps.

[PatrickCavell85782]

Thanks Jennifer. That was very helpful.