Skip to main content
Version: 1.19.0 (latest)

Why DNS Is an Architectural Control

In most enterprise environments, DNS is treated as foundational but passive: a directory that maps names to IP addresses. It is provisioned early, configured once, and rarely revisited as an architectural concern.

Kasm Workspaces does not inherit this assumption. In a web-native, Zero Trust platform where every interaction is mediated through a browser, DNS plays a fundamentally different role. It directly governs whether:

  • Browser security policies allow session establishment
  • Authentication context can traverse system components
  • WebSocket-based session streaming succeeds

In Kasm DNS is much more than just naming, it also affects system enforcement boundaries.


The Browser as an Active Enforcement Engine

The most important mental model shift for Enterprise Architects unfamiliar with web-native systems is recognizing that modern browsers are not passive clients. They are active security enforcement engines that apply strict rules around:

  • Same-origin policies
  • Cookie scoping rules
  • Cross-origin request validation
  • TLS certificate trust

When a user launches a Kasm session, the browser evaluates whether connections are permitted based on DNS-resolved hostnames, domain relationships, and TLS certificate validity. If DNS and domain design do not align with these rules, session establishment does not degrade, it fails outright.

note

Symptoms of DNS and domain misalignment in Kasm deployments, including WebSocket connections failing, sessions not launching, and inconsistent authentication, closely resemble firewall issues, routing problems, and load balancer misconfiguration. Always verify DNS design and domain alignment before examining firewall rules or network paths.


Domain Relationships Define Authentication Flow

The relationship between hostnames defines how identity flows through the system.

The Child Domain Model (Preferred)

When the Web App is at kasm.example.com and the proxy is at proxy.kasm.example.com:

  • The browser automatically sends cookies scoped to kasm.example.com to proxy.kasm.example.com
  • Authentication context flows naturally
  • Fewer cross-origin constraints need to be managed

The Sibling Domain Model (Complex)

When the Web App is at kasm.example.com and the proxy is at proxy.example.com:

  • The browser will not automatically send the kasm.example.com cookie to proxy.example.com
  • Cross-origin validation must be explicitly configured
  • Every component must agree perfectly on Allow Origin Domain, Upstream Auth Address, and TLS expectations
ModelCookie SharingCross-Origin Config RequiredFailure Surface
Child domain (preferred)AutomaticMinimalNarrow
Sibling domain (complex)Not automaticExtensiveBroad

Most enterprise Kasm deployments choose the child domain approach because it reduces the configuration surface area and makes failure modes easier to diagnose.


DNS, TLS, and Load Balancers Form a Single System

In Kasm deployments, DNS does not operate independently. It forms a tightly coupled system with load balancers and TLS certificates:

  • DNS resolves hostnames to load balancer endpoints, not individual server nodes
  • TLS certificates must be issued for the public hostnames that browsers use
  • Internal node names are irrelevant to the browser, which only trusts what DNS and TLS present

Wildcard certificates covering the chosen domain hierarchy, for example *.kasm.example.com, are commonly used not as a convenience measure but to maintain consistency across distributed proxy endpoints in multi-server and multi-zone deployments.


The Session Chain: Where DNS Participates at Every Step

Every Kasm session depends on an unbroken chain of operations where DNS is present at multiple points:

  1. Browser resolves the Web App hostname via DNS
  2. Browser connects to the Web App, establishes HTTPS, and authenticates
  3. The API returns a Proxy Hostname for session streaming
  4. Browser resolves the Proxy Hostname via DNS
  5. Browser initiates a WebSocket connection to the proxy
  6. The proxy validates the session token via the Web App

At every step, the hostname must resolve correctly, the certificate must match, and the origin must be permitted. A failure at any link in this chain produces a session failure.


DNS Significance Across the Reference Architectures

The role DNS plays scales with the complexity of the deployment.

ArchitectureDNS RoleComplexityFailure Impact
RA1 (Single Server)Identity: single hostname defines the entire system boundaryLowImmediate failure
RA2 (Single Server Control Plane)Identity plus abstraction: single public hostname; Agents are invisible to DNSLowImmediate if Proxy Hostname cannot resolve
RA3 (Single Zone Multi-Server)Identity plus scaling: DNS resolves to load balancers; certificates must match public hostnamesMediumInconsistent behavior across sessions
RA4 (Multi-Zone Multi-Server)Identity plus routing plus locality: DNS enables geographic routing and zone-aware session deliveryHighSystem-wide session delivery failure

In RA4, DNS becomes the routing fabric of the session plane. Each zone has its own proxy hostname that resolves to a zone-specific load balancer in a geographically distributed region. A typical RA4 DNS design:

HostnamePurposeResolves To
kasm.example.comGlobal control plane entryRegion 1 global load balancer
us.kasm.example.comUS zone session load balancerRegion 1 session load balancer
eu.kasm.example.comEU zone session load balancerRegion 2 session load balancer

Each of these hostnames must resolve globally, present a valid TLS certificate, be included in origin validation configuration, and reach a functioning proxy. Any mismatch breaks session delivery for the affected zone.


DNS as a Zero Trust Enabler

Across all reference architectures, DNS supports Zero Trust principles by:

  • Forcing all access through controlled endpoints
  • Defining the public identity of each role in the system
  • Ensuring traffic flows through named, managed entry points rather than implicit network routes
  • In RA4 especially, enabling secure global distribution without exposing internal topology

The deeper insight: in Kasm Workspaces, DNS defines who the system is, TLS proves that identity is valid, and the browser enforces whether interaction is permitted. Naming, security, and connectivity are inseparable. DNS is not just how the system is found. It is how the system is allowed to exist.


This article is part of the Kasm Workspaces Reference Architecture Explanation Series.