ISM-2017policyASD Information Security Manual (ISM)

Encrypt DNS Traffic Between Clients and Servers

DNS lookups sent between your devices and DNS servers must be encrypted using cryptography approved by the Australian Signals Directorate (ASD).

Preventative NC OS PASD Information Security ManualGuidelines for networking Cryptography Network security

record_voice_over

Plain language

Every time a device on your network looks up a website address, it sends a request to a DNS (Domain Name System) server, which acts like the internet's phone book by turning a name such as example.com into a numeric address. By default these lookups travel in plain text, so anyone watching the network can see and even tamper with which sites your people are visiting. This control requires that DNS traffic between your devices (clients) and your DNS servers is scrambled (encrypted) using cryptography that the Australian Signals Directorate (ASD) has approved, so the lookups cannot be read or altered in transit.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

June 2026

Control Stack last updated

18 June 2026

E8 maturity levels

N/A

Guideline

Guidelines for networking

Section

Network Design and Configuration

Topic

Encrypted Domain Name System Services

Official control statement

DNS traffic is encrypted by clients and servers using ASD-approved cryptography.

policyASD Information Security Manual (ISM)ISM-2017

priority_high

Why it matters

If DNS lookups are sent in plain text, attackers can spy on which sites your staff visit and redirect them to fake websites to steal credentials or deliver malware.

settings

Operational notes

Recheck the DNS encryption settings whenever the Australian Signals Directorate updates its approved cryptography, and confirm new or rebuilt devices use the encrypted servers rather than plain-text DNS.

02 - Implement

build

Implementation tips

The IT administrator should turn on encrypted DNS on the organisation's DNS servers by enabling DNS over Transport Layer Security (DoT) or DNS over HTTPS (DoH), which are the two standard ways of scrambling DNS lookups.
The IT administrator should configure all client devices (laptops, desktops, phones) to send their DNS lookups only to the approved encrypted DNS servers, blocking plain-text DNS so devices cannot quietly fall back to the unencrypted method.
When setting up encryption, the person configuring the servers must select only the cipher suites and protocol versions listed as approved in the Australian Signals Directorate (ASD) Information Security Manual, rather than leaving the default settings in place.
The network or firewall administrator should block outbound plain-text DNS (traffic on UDP and TCP port 53) at the firewall, forcing every lookup through the encrypted DNS service so no device can bypass it.
The IT team should record which DNS servers, protocols (DoT or DoH), and ASD-approved cryptographic settings are in use in a short configuration document, and review it whenever ASD updates its approved algorithms.

03 - Audit

fact_check

Audit / evidence tips

Askthe IT team to show the DNS server configurationLook atwhether DNS over TLS (DoT) or DNS over HTTPS (DoH) is enabled and which cipher suites are setGooddemonstrates encryption is switched on and limited to ASD-approved algorithms, not left on defaults
Askwhich cryptographic algorithms and protocol versions are used for DNS encryptionLook atthe configured settings against the current Australian Signals Directorate (ASD) approved list in the Information Security ManualGoodmatches the approved list exactly with no deprecated ciphers
Askhow client devices are pointed at the encrypted DNS serviceLook atthe device or group policy settings that set the DNS serverGoodshows all clients are centrally configured to use only the encrypted servers
Askhow plain-text DNS is preventedLook atfirewall rules that block outbound port 53 and any fallback pathsGoodshows unencrypted DNS is blocked so devices cannot silently revert to it
Askproof that the encryption is actually working in practiceLook atpacket captures, server logs, or a connection test showing DNS traffic is encryptedGoodprovides recent evidence that real lookups were encrypted end to end

04 - Mappings

link

Cross-framework mappings

How ISM-2017 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(2)expand_less
Annex A 8.20	ISM-2017 requires DNS traffic to be encrypted between clients and servers wherever supported to protect DNS queries and responses from in...
Annex A 8.24	ISM-2017 requires organisations to encrypt DNS traffic where supported, typically via cryptographic protections at the transport or appli...