Android and iOS

DNS and certificate trust in mobile connections

TLS, authorization, request integrity, caching and network failures.

Network and API protection1 min readEditorial methods

DNS resolves a name to a destination; TLS still needs to verify that the application reached the intended service.

Evaluation approach

Validate certificates against the expected hostname and test network and resolver changes.

Application example

Switching between public Wi-Fi and cellular must not cause a silent fallback to HTTP.

Limits and considerations

Encrypted DNS does not fix application authentication or authorization errors.

Managing domain changes

Assess older clients' connection and certificate expectations during API-domain migrations. Redirects must not silently broaden the trust boundary.

Checks and decisions

  • Use expected hostnames
  • Remove insecure fallbacks
  • Test network transitions

Sources

The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.