Why Treating DNS as Network Plumbing Is a Security Decision You'll Regret | Andrew Wertkin | EP #17

Andrew Wertkin is Chief Strategy Officer at BlueCat and has spent over a decade working with some of the world's largest enterprises on DNS, DHCP, and IP address management.BlueCat has been in the DDI business for 24 years, processing hundreds of billions of DNS queries a month across customers in finance, healthcare, manufacturing, retail, and education. Andrew spends a significant amount of that time inside customer environments when things go wrong, which gives him a ground-level view of where enterprise security and network observability actually break down.EP #17 goes deep on DNS as a signal and control plane. Not the marketing version. The version where a spike in query traffic turns out to be a buggy MDM agent, where encrypted DNS quietly kills the visibility your security team depends on, and where a major outage call turns into nine teams trying to prove it was someone else's problem.Andrew doesn't pitch. He explains the tradeoffs, names the failure patterns, and makes the case for why most enterprises are sitting on more DNS intelligence than they know what to do with.What we cover in this EP:◼ Why DNS is still criminally underused as a security control plane in most enterprises, even in 2026◼ The encrypted DNS tradeoff nobody talks about: DoH gives you privacy and costs you visibility, and why DoT is the more honest option for enterprise networks◼ How BlueCat uses IPAM metadata to flip DNS from a blocklist to a behavioral allowlist based on what each device type should actually be querying◼ The false alarm war stories: a hundredfold query spike that turned out to be a buggy MDM agent, and a UDP-to-TCP fallback that looked like a DDoS◼ Why enterprise outage calls become blame games and what having DNS observability data does to the mean time to innocence(0:00) – Andrew's background and BlueCat's 24 years in DNS(02:14) – Why DNS is still the most overlooked security layer(04:51) – From service reliability to cyber observability(12:28) – On-prem vs cloud DNS: where each belongs(19:03) – Encrypted DNS lands: DoH, DoT, DoQ explained(23:34) – Why DoH hurts enterprise visibility more than it helps(29:57) – Zero trust models and what happens to DNS visibility(39:20) – The MDM bug that looked exactly like a DDoS(43:20) – SolarWinds customers and DNS forensics(45:50) – Device identification through DNS behavior(51:46) – DNS tunneling and the Indonesia carrier story(56:52) – Microsoft 365 and the DNS nobody updated(57:52) – Nine teams on a call, zero answers, one outage(1:02:07) – What Google Chrome quietly does to your DNS dataGuest ⬇️Andrew WertkinHosts ⬇️Yegor Sak & Alex PaguisPowered by Control D