Zero-touch secure DNS device provisioning

A system comprising:

• a memory comprising instructions;
• and
• a processor configured to execute the instructions which, when executed, cause the processor to:
• receive, at a mobile device management service, a configuration profile from a risk assessment service, wherein the risk assessment service generated the configuration profile to comprise service policies associated with domain name system (DNS) traffic and an HTTPS URL;
• modify, by the mobile device management service, the HTTPS URL of the configuration profile to include a Unique Device Identifier (UDID) associated with a target device;
• transmit, by the mobile device management service to the target device, the configuration profile comprising the HTTPS URL with the UDID associated with the target device, wherein the risk assessment service, responsive to the target device receiving the configuration profile from the mobile device management service, generates a device object based on the configuration profile comprising the HTTPS URL with the UDID;
• identify agentlessly, by the mobile device management service, based on the UDID, meta data associated with the target device for returning a DNS response to a DNS request from the target device;
• and
• maintain service for the target device when the target device is identified as being administratively decommissioned, wherein the service policies comprise a capability to limit access to Domain Name System over HTTPS (DoH) URLs based on a client certificate associated with the target device.

A non-transitory machine-readable storage medium comprising machine-readable instructions for causing a processor to execute a method, the method comprising:

• receiving, at a mobile device management service, a configuration profile from a risk assessment service, wherein the risk assessment service generated the configuration profile to comprise service policies associated with domain name system (DNS) traffic and an HTTPS URL;
• modifying, by the mobile device management service, the HTTPS URL of the configuration profile to include a Unique Device Identifier (UDID) associated with a target device;
• transmitting, by the mobile device management service to the target device, the configuration profile comprising the HTTPS URL with the UDID associated with the target device, wherein the risk assessment service, responsive to the target device receiving the configuration profile from the mobile device management service, generates a device object based on the configuration profile comprising the HTTPS URL with the UDID;
• identifying agentlessly, by the mobile device management service, based on the UDID, meta data associated with the target device for returning a DNS response to a DNS request from the target device;
• and
• maintaining service for the target device when the target device is identified as being administratively decommissioned, wherein the service policies comprise a capability to limit access to Domain Name System over HTTPS (DoH) URLs based on a client certificate associated with the target device.