{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/baseline-windows-dns-over-https-events-and-counters-separately-from-port-53/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/baseline-windows-dns-over-https-events-and-counters-separately-from-port-53/",
        "slug": "baseline-windows-dns-over-https-events-and-counters-separately-from-port-53",
        "url": "https://update.dsesecurity.com/updates/baseline-windows-dns-over-https-events-and-counters-separately-from-port-53/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/baseline-windows-dns-over-https-events-and-counters-separately-from-port-53.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/baseline-windows-dns-over-https-events-and-counters-separately-from-port-53/"
        },
        "title": "Baseline Windows DNS-over-HTTPS events and counters separately from port 53",
        "summary": "Use Monitor DNS over HTTPS events and performance in DNS Server on Windows Server to review this narrow operational decision without extending the source beyond its stated scope.",
        "format": {
            "slug": "checklist",
            "name": "Checklist"
        },
        "priority": {
            "slug": "advisory",
            "name": "Advisory"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-08-27T12:15:39+00:00",
        "modified_at": "2026-08-27T12:53:58+00:00",
        "reviewed_on": "2026-08-26",
        "reading_minutes": 3,
        "word_count": 536,
        "potentially_affected": "Teams, systems, services, or facilities within the stated scope of Monitor DNS over HTTPS events and performance in DNS Server on Windows Server",
        "dse_recommendation": "Compare the observed state with the cited official source, document applicability and exceptions, and test any approved change with rollback safeguards.",
        "primary_source": {
            "name": "Monitor DNS over HTTPS events and performance in DNS Server on Windows Server",
            "url": "https://learn.microsoft.com/en-us/windows-server/networking/dns/monitor-dns-over-https",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Treat this document as a focused evidence review: Baseline Windows DNS-over-HTTPS events and counters separately from port 53. Only the official source and traced locations below supply facts. Confirm applicability before acting.</p>\n<h2>Source fact:</h2>\n<p>The official <a href=\"https://learn.microsoft.com/en-us/windows-server/networking/dns/monitor-dns-over-https\" target=\"_blank\" rel=\"noopener noreferrer\">Monitor DNS over HTTPS events and performance in DNS Server on Windows Server</a> from Microsoft supports the following bounded statements:</p>\n<ul>\n<li>Windows DNS Server records DNS-over-HTTPS operational events in dedicated DNS Server event-log channels described by the page. The research record locates this support at <strong>Monitor events; Event channels and event IDs</strong>.</li>\n<li>Windows exposes separate DNS-over-HTTPS request, response, and dropped-request performance counters, and those counters reset when the DNS Server service restarts. The research record locates this support at <strong>Monitor performance; DNS-over-HTTPS performance counters; Note</strong>.</li>\n</ul>\n<p>Do not import neighboring assumptions into the source record. The supported task is a scoped comparison involving Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles and the conditions the source actually describes.</p>\n<h2>What the source does not establish</h2>\n<p>These events and counters show Windows DNS-over-HTTPS activity and drops; they do not by themselves establish confidentiality, client adoption, root cause, or acceptable capacity. It does not establish a deployment&#8217;s current state, authorize a production change, prove compliance, or show that Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution are healthy. Documented options are review inputs, not universal mandates.</p>\n<h2>Applicability questions</h2>\n<ul>\n<li>For source statement 1 at <strong>Monitor events; Event channels and event IDs</strong>, which observable configuration, record, or test can confirm applicability here?</li>\n<li>For source statement 2 at <strong>Monitor performance; DNS-over-HTTPS performance counters; Note</strong>, which observable configuration, record, or test can confirm applicability here?</li>\n<li>What inventory proves which parts of Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles are in and out of scope?</li>\n<li>Which condition in Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution must be healthy before evidence is trustworthy?</li>\n<li>What result would disprove the working assumption and return the issue to the owner?</li>\n</ul>\n<h2>DSE recommendation:</h2>\n<p>DSE recommends using the cited source as the evidence anchor for this decision. Use a two-person review for the source interpretation and the resulting operational decision. Record the source location, examined part of Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles, observed and expected states, owner, and reason for deviation.</p>\n<p>If the review warrants change, use a bounded implementation with prerequisites, test population, monitoring, abort criteria, and a rehearsed reversal. Sequence checks for Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution and sanitize protected material before retention.</p>\n<h2>Verification and evidence</h2>\n<p>Evidence should let another reviewer reproduce this decision. Retain observations beside the traced locations <strong>Monitor events; Event channels and event IDs</strong>; <strong>Monitor performance; DNS-over-HTTPS performance counters; Note</strong>. Favor PowerShell exports, zone and policy inventories, sanitized query tests, event-channel data, replication state, and rollback commands, linked to stable identifiers, time, and operator.</p>\n<p>Retain the starting state, authorization, execution record, outcome, deviation, and final state as one review package. Move disruptive checks to an approved test path. Reopen the decision when versions, design, dependencies, ownership, or official guidance changes.</p>\n<h2>Official references</h2>\n<ul>\n<li><a href=\"https://learn.microsoft.com/en-us/windows-server/networking/dns/monitor-dns-over-https\" target=\"_blank\" rel=\"noopener noreferrer\">Monitor DNS over HTTPS events and performance in DNS Server on Windows Server</a> — Microsoft</li>\n</ul>",
        "content_text": "Treat this document as a focused evidence review: Baseline Windows DNS-over-HTTPS events and counters separately from port 53. Only the official source and traced locations below supply facts. Confirm applicability before acting.\nSource fact:\nThe official Monitor DNS over HTTPS events and performance in DNS Server on Windows Server from Microsoft supports the following bounded statements:\n\nWindows DNS Server records DNS-over-HTTPS operational events in dedicated DNS Server event-log channels described by the page. The research record locates this support at Monitor events; Event channels and event IDs.\nWindows exposes separate DNS-over-HTTPS request, response, and dropped-request performance counters, and those counters reset when the DNS Server service restarts. The research record locates this support at Monitor performance; DNS-over-HTTPS performance counters; Note.\n\nDo not import neighboring assumptions into the source record. The supported task is a scoped comparison involving Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles and the conditions the source actually describes.\nWhat the source does not establish\nThese events and counters show Windows DNS-over-HTTPS activity and drops; they do not by themselves establish confidentiality, client adoption, root cause, or acceptable capacity. It does not establish a deployment’s current state, authorize a production change, prove compliance, or show that Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution are healthy. Documented options are review inputs, not universal mandates.\nApplicability questions\n\nFor source statement 1 at Monitor events; Event channels and event IDs, which observable configuration, record, or test can confirm applicability here?\nFor source statement 2 at Monitor performance; DNS-over-HTTPS performance counters; Note, which observable configuration, record, or test can confirm applicability here?\nWhat inventory proves which parts of Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles are in and out of scope?\nWhich condition in Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution must be healthy before evidence is trustworthy?\nWhat result would disprove the working assumption and return the issue to the owner?\n\nDSE recommendation:\nDSE recommends using the cited source as the evidence anchor for this decision. Use a two-person review for the source interpretation and the resulting operational decision. Record the source location, examined part of Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles, observed and expected states, owner, and reason for deviation.\nIf the review warrants change, use a bounded implementation with prerequisites, test population, monitoring, abort criteria, and a rehearsed reversal. Sequence checks for Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution and sanitize protected material before retention.\nVerification and evidence\nEvidence should let another reviewer reproduce this decision. Retain observations beside the traced locations Monitor events; Event channels and event IDs; Monitor performance; DNS-over-HTTPS performance counters; Note. Favor PowerShell exports, zone and policy inventories, sanitized query tests, event-channel data, replication state, and rollback commands, linked to stable identifiers, time, and operator.\nRetain the starting state, authorization, execution record, outcome, deviation, and final state as one review package. Move disruptive checks to an approved test path. Reopen the decision when versions, design, dependencies, ownership, or official guidance changes.\nOfficial references\n\nMonitor DNS over HTTPS events and performance in DNS Server on Windows Server — Microsoft",
        "content_markdown": "Treat this document as a focused evidence review: Baseline Windows DNS-over-HTTPS events and counters separately from port 53. Only the official source and traced locations below supply facts. Confirm applicability before acting.\n\n## Source fact:\n\nThe official [Monitor DNS over HTTPS events and performance in DNS Server on Windows Server](https://learn.microsoft.com/en-us/windows-server/networking/dns/monitor-dns-over-https) from Microsoft supports the following bounded statements:\n\n- Windows DNS Server records DNS-over-HTTPS operational events in dedicated DNS Server event-log channels described by the page. The research record locates this support at Monitor events; Event channels and event IDs.\n\n- Windows exposes separate DNS-over-HTTPS request, response, and dropped-request performance counters, and those counters reset when the DNS Server service restarts. The research record locates this support at Monitor performance; DNS-over-HTTPS performance counters; Note.\n\nDo not import neighboring assumptions into the source record. The supported task is a scoped comparison involving Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles and the conditions the source actually describes.\n\n## What the source does not establish\n\nThese events and counters show Windows DNS-over-HTTPS activity and drops; they do not by themselves establish confidentiality, client adoption, root cause, or acceptable capacity. It does not establish a deployment’s current state, authorize a production change, prove compliance, or show that Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution are healthy. Documented options are review inputs, not universal mandates.\n\n## Applicability questions\n\n- For source statement 1 at Monitor events; Event channels and event IDs, which observable configuration, record, or test can confirm applicability here?\n\n- For source statement 2 at Monitor performance; DNS-over-HTTPS performance counters; Note, which observable configuration, record, or test can confirm applicability here?\n\n- What inventory proves which parts of Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles are in and out of scope?\n\n- Which condition in Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution must be healthy before evidence is trustworthy?\n\n- What result would disprove the working assumption and return the issue to the owner?\n\n## DSE recommendation:\n\nDSE recommends using the cited source as the evidence anchor for this decision. Use a two-person review for the source interpretation and the resulting operational decision. Record the source location, examined part of Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles, observed and expected states, owner, and reason for deviation.\n\nIf the review warrants change, use a bounded implementation with prerequisites, test population, monitoring, abort criteria, and a rehearsed reversal. Sequence checks for Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution and sanitize protected material before retention.\n\n## Verification and evidence\n\nEvidence should let another reviewer reproduce this decision. Retain observations beside the traced locations Monitor events; Event channels and event IDs; Monitor performance; DNS-over-HTTPS performance counters; Note. Favor PowerShell exports, zone and policy inventories, sanitized query tests, event-channel data, replication state, and rollback commands, linked to stable identifiers, time, and operator.\n\nRetain the starting state, authorization, execution record, outcome, deviation, and final state as one review package. Move disruptive checks to an approved test path. Reopen the decision when versions, design, dependencies, ownership, or official guidance changes.\n\n## Official references\n\n- [Monitor DNS over HTTPS events and performance in DNS Server on Windows Server](https://learn.microsoft.com/en-us/windows-server/networking/dns/monitor-dns-over-https) — Microsoft"
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/baseline-windows-dns-over-https-events-and-counters-separately-from-port-53/",
                "url": "https://update.dsesecurity.com/updates/baseline-windows-dns-over-https-events-and-counters-separately-from-port-53/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-08-26"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/baseline-windows-dns-over-https-events-and-counters-separately-from-port-53/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Baseline Windows DNS-over-HTTPS events and counters separately from port 53",
                        "item": "https://update.dsesecurity.com/updates/baseline-windows-dns-over-https-events-and-counters-separately-from-port-53/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/baseline-windows-dns-over-https-events-and-counters-separately-from-port-53/#article",
                "identifier": "https://update.dsesecurity.com/updates/baseline-windows-dns-over-https-events-and-counters-separately-from-port-53/",
                "url": "https://update.dsesecurity.com/updates/baseline-windows-dns-over-https-events-and-counters-separately-from-port-53/",
                "headline": "Baseline Windows DNS-over-HTTPS events and counters separately from port 53",
                "description": "Use Monitor DNS over HTTPS events and performance in DNS Server on Windows Server to review this narrow operational decision without extending the…",
                "abstract": "Use Monitor DNS over HTTPS events and performance in DNS Server on Windows Server to review this narrow operational decision without extending the source beyond its stated scope.",
                "articleBody": "Treat this document as a focused evidence review: Baseline Windows DNS-over-HTTPS events and counters separately from port 53. Only the official source and traced locations below supply facts. Confirm applicability before acting.\nSource fact:\nThe official Monitor DNS over HTTPS events and performance in DNS Server on Windows Server from Microsoft supports the following bounded statements:\n\nWindows DNS Server records DNS-over-HTTPS operational events in dedicated DNS Server event-log channels described by the page. The research record locates this support at Monitor events; Event channels and event IDs.\nWindows exposes separate DNS-over-HTTPS request, response, and dropped-request performance counters, and those counters reset when the DNS Server service restarts. The research record locates this support at Monitor performance; DNS-over-HTTPS performance counters; Note.\n\nDo not import neighboring assumptions into the source record. The supported task is a scoped comparison involving Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles and the conditions the source actually describes.\nWhat the source does not establish\nThese events and counters show Windows DNS-over-HTTPS activity and drops; they do not by themselves establish confidentiality, client adoption, root cause, or acceptable capacity. It does not establish a deployment’s current state, authorize a production change, prove compliance, or show that Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution are healthy. Documented options are review inputs, not universal mandates.\nApplicability questions\n\nFor source statement 1 at Monitor events; Event channels and event IDs, which observable configuration, record, or test can confirm applicability here?\nFor source statement 2 at Monitor performance; DNS-over-HTTPS performance counters; Note, which observable configuration, record, or test can confirm applicability here?\nWhat inventory proves which parts of Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles are in and out of scope?\nWhich condition in Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution must be healthy before evidence is trustworthy?\nWhat result would disprove the working assumption and return the issue to the owner?\n\nDSE recommendation:\nDSE recommends using the cited source as the evidence anchor for this decision. Use a two-person review for the source interpretation and the resulting operational decision. Record the source location, examined part of Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles, observed and expected states, owner, and reason for deviation.\nIf the review warrants change, use a bounded implementation with prerequisites, test population, monitoring, abort criteria, and a rehearsed reversal. Sequence checks for Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution and sanitize protected material before retention.\nVerification and evidence\nEvidence should let another reviewer reproduce this decision. Retain observations beside the traced locations Monitor events; Event channels and event IDs; Monitor performance; DNS-over-HTTPS performance counters; Note. Favor PowerShell exports, zone and policy inventories, sanitized query tests, event-channel data, replication state, and rollback commands, linked to stable identifiers, time, and operator.\nRetain the starting state, authorization, execution record, outcome, deviation, and final state as one review package. Move disruptive checks to an approved test path. Reopen the decision when versions, design, dependencies, ownership, or official guidance changes.\nOfficial references\n\nMonitor DNS over HTTPS events and performance in DNS Server on Windows Server — Microsoft",
                "datePublished": "2026-08-27T12:15:39+00:00",
                "dateModified": "2026-08-27T12:53:58+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/baseline-windows-dns-over-https-events-and-counters-separately-from-port-53/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/baseline-windows-dns-over-https-events-and-counters-separately-from-port-53/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Baseline Windows DNS-over-HTTPS events and counters separately from port 53"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Networks & Infrastructure",
                    "Checklist",
                    "Advisory priority"
                ],
                "genre": "Checklist",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 536,
                "timeRequired": "PT3M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Monitor DNS over HTTPS events and performance in DNS Server on Windows Server",
                    "url": "https://learn.microsoft.com/en-us/windows-server/networking/dns/monitor-dns-over-https"
                }
            }
        ]
    }
}