Technical Tip: DNS over TLS (DoT) mitigates 'Secure Client-Initiated Renegotiation' or 'Client-initiated Renegotiations'

[Oscar_Wee]

Description	This article explains why DNS over TLS (DoT) is able to mitigate 'Secure Client-Initiated Renegotiation' or 'Client-initiated Re-negotiations'.
Scope	FortiGate.
Solution	DNS over TLS (DoT) is not intrinsically susceptible to the legacy SSL/TLS client-initiated renegotiation vulnerability, as its reliance on TLS 1.2 or 1.3 ensures the use of protocol-level controls that either substantially mitigate or entirely preclude this attack vector. Rate Limiting: Contemporary DoT servers and modern TLS stacks typically enforce stringent rate-limiting controls on renegotiation handshakes—assuming the mechanism is enabled at all—which substantially reduces the feasibility of renegotiation-based DoS vectors. Consequently, while this vulnerability may still be present in legacy or misconfigured SSL/TLS deployments, current DoT implementations are architected to provide robust protection against such exploitation. Hence, the 'Secure Client-Initiated Renegotiation' vulnerability report on DNS over TLS (DoT) is a false positive.