Applicability
Which parts of this book apply in commercial cloud, GCC-Moderate, GCC High, DoD and air-gapped environments.
This page is included in the whole book as a Word document.
The architecture in this book (one authoritative DDI policy plane, agency-controlled resolvers as the first hop, consistent forwarding and policy everywhere) applies in every environment. What changes from one environment to the next is which services are authorized, which integrations exist, and which optimizations are available. This page sets out those boundaries so that readers in higher-impact environments know which statements in later chapters need adjusting.
The book uses GCC-Moderate for the Microsoft 365 Government Community Cloud offering that Microsoft documents as “GCC”. It runs on the Worldwide (commercial) service instance and is used at FedRAMP Moderate.
Primary Scope: Commercial Cloud at FedRAMP Moderate
The book is written for agencies whose workloads run in commercial Azure, commercial AWS Regions and Google Cloud, with Microsoft 365 in GCC-Moderate, at the FedRAMP Moderate impact level. In this environment:
- Everything in Chapters 01–11 applies as written.
- A DDI management service delivered as SaaS must hold a FedRAMP Moderate authorization (or better) and an agency ATO. On-premises and in-tenant resolvers stay inside the agency’s own boundary (Chapter 03).
- Microsoft 365 informed network routing is not available. Microsoft supports it only in the Worldwide commercial cloud, not GCC-Moderate (Chapter 05).
- The AWS VPC IPAM integration with an external IPAM is available in commercial AWS Regions (Chapter 07).
- Microsoft 365 GCC-Moderate uses the Worldwide endpoint list, so the DNS risk is path consistency rather than resolving to the wrong cloud (Chapter 02).
GCC High, Azure Government and AWS GovCloud (High)
The architecture is unchanged. The differences are in authorization and integration:
- A policy plane authorized only at FedRAMP Moderate does not cover High-impact systems. Either use a service authorized at High, or keep the policy plane inside the agency’s own High boundary (on-premises or in-tenant management), and confirm with the authorizing official.
- Microsoft 365 GCC High uses its own endpoints and namespaces, many under .us domains, and every resolver must answer them correctly (Chapter 02).
- INR is not available.
- The AWS VPC IPAM–Infoblox integration is not available in the AWS GovCloud (US) Regions. Treat GovCloud like Azure and Google Cloud in Chapter 07: discovery, reconciliation and a reservation process.
- Azure Government feature availability differs from commercial Azure. Confirm Azure DNS Private Resolver, DNS security policy and DNSSEC availability in the target Azure Government regions before design.
DoD (Impact Levels 4 and 5)
Everything in the GCC High section applies, plus the DoD Cloud Computing Security Requirements Guide and component-specific requirements. This book does not map those requirements. Treat Chapter 03 and the control mapping as a starting point only, and confirm provisional authorization status at the required impact level for every cloud service in the design.
Air-Gapped and Classified Networks
The core design still applies: one authoritative policy plane, agency resolvers as the first hop, consistent forwarding, DNSSEC validation under agency control and full logging. Several things in this book do not:
- No SaaS management plane. The policy plane, resolvers and IPAM run entirely inside the enclave.
- No CISA Protective DNS forwarding and no public recursion. Internet-facing guidance in Chapters 02 and 05 does not apply; local response policy zones carry threat intelligence that is imported through approved cross-domain processes.
- DNSSEC trust anchors and any internal root are managed locally.
- Cloud-provider integrations apply only where the provider offers a corresponding isolated region, and their availability must be confirmed separately.
Mission-specific guidance governs these environments, and this book’s sources do not cover them.
Quick Reference
| Single DDI policy plane |
Applies |
Applies |
Applies |
Applies |
| SaaS management at FedRAMP Moderate |
Sufficient with agency ATO |
Not sufficient alone |
Not sufficient alone |
Not applicable |
| CISA Protective DNS forwarding |
Required for FCEB egress |
Required for FCEB egress |
Per DoD requirements |
Not applicable |
| Microsoft 365 INR |
Not in GCC-Moderate (Worldwide commercial only) |
Not available |
Not available |
Not applicable |
| AWS VPC IPAM external-IPAM integration |
Commercial Regions |
Not in GovCloud |
Not in GovCloud |
Not applicable |
| Azure Private DNS DNSSEC signing |
Not supported (public zones only) |
Not supported |
Not supported |
Not applicable |
Previous: Next Generation DDI — book home
Next: Chapter 01 — DNS Is Now the Control Plane
Back to top