This paper provides basic information on the benefits and potential issues with encrypting DNS traffic for both end-users wanting to implement encrypted DNS on their personal devices or home broadband networks and for ISPs or enterprise administrators considering it for their corporate networks, including recommendations for M3AAWG members and the online anti-abuse eco-system. The companion document “M3AAWG Companion Document: Recipes for Encrypting DNS Stub Resolver-to-Recursive Resolver Traffic” provides detailed instructions and processes.

This document identifies a minimum set of security requirements that should be specified when ISPs purchase customer premise equipment to ensure that the CPE has a secure default configuration and a secure remote management and update mechanism. These joint best practices were developed by LACNOG (Latin American and Caribbean Network Operators Group) and M3AAWG, and is the product of LACNOG's original drafts by its working groups LAC-AAWG (Latin American and Caribbean Anti-Abuse Working Group) and BCOP Working Group, in cooperation with M3AAWG members, Senior Technical Advisors and the M3AAWG Technical Committee.