Networking / VPC / Controls / v2026.11
Filter and Log DNS Queries
CCC.VPC.CN09 · Networking
Ensure that the built-in resolver refuses queries to blocked domains and records every query, so that DNS cannot be used as an unobserved exfiltration channel.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.VPC.CP14 | Built-in DNS Resolution | The service automatically resolves hostnames to IP addresses for resources within the virtual network, allowing resources to communicate using hostnames instead of IP addresses. |
Related Threats
| ID | Title | Description |
|---|
| CCC.VPC.TH12 | DNS Queries are Used as a Covert Exfiltration Channel | The built-in resolver forwards queries for any external domain, so a compromised resource can encode data in DNS queries to a domain it controls even when other outbound traffic is blocked. Data leaves the network without traversing the filtered egress path, impacting the confidentiality of data. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.VPC.CN09.AR01 | When a resource queries a domain that is on a blocked list or is not on an allowed list, the built-in resolver MUST refuse to resolve it. | tlp-amber, tlp-red |
| CCC.VPC.CN09.AR02 | When the built-in resolver answers a query, the service MUST log the source, queried name, and response code. | tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| NIST_800_53 | SC-7 | |
| NIST_800_53 | AU-12 | |