Enhanced internal host detection protocol

A method, comprising:

• sending a response to a get configuration query from a portal for a cloud security service to an endpoint agent;
• routing a DNS reverse lookup query to a predetermined IP address associated with a DNS proxy associated with the cloud security service, wherein the routing of the DNS reverse lookup query comprises routing the DNS reverse lookup query to a remote network (RN) that hosts the DNS proxy;
• sending a response to the DNS reverse lookup query from the DNS proxy associated with the cloud security service;
• and
• verifying that the response to the DNS reverse lookup query is not spoofed based on a match with the response to the get configuration query.

A system, comprising:

• a processor configured to:
• means for sending a response to a get configuration query from a portal for a cloud security service to an endpoint agent;
• route a DNS reverse lookup query to a predetermined IP address associated with a DNS proxy associated with the cloud security service, wherein the routing of the DNS reverse lookup query comprises to route the DNS reverse lookup query to a remote network (RN) that hosts the DNS proxy;
• means for sending a response to the DNS reverse lookup query from the DNS proxy associated with the cloud security service;
• and
• means for verifying that the response to the DNS reverse lookup query is not spoofed based on a match with the response to the get configuration query;
• and
• a memory coupled to the processor and configured to provide the processor with instructions.