Selectively performing man in the middle decryption

1. A method performed by data processing apparatus, the method comprising:

receiving, from a device within a network, a domain name service (DNS) request for an address of a first resource outside the network;

determining that the first resource is associated with a security policy of the network that specifies decrypting encrypted traffic between the device within the network and the first resource;

responsive to the determination that the first resource is associated with a security policy of the network that specifies decrypting encrypted traffic between the device within the network and the first resource, returning, to the device within the network in response the DNS request, a DNS response comprising an address of a gateway within the network, the gateway address having previously been associated with the first resource address;

establishing a first encrypted connection between the device and the gateway, and a second encrypted connection between the gateway and the first resource, to facilitate encrypted communication traffic between the device and the first resource;

decrypting, by the gateway, all of the encrypted communication traffic passing between the device and the first resource such that all of the encrypted communication traffic passing between the device and the first resource is available to the gateway for inspection; and

inspecting at least some of the encrypted communication traffic passing between the device and the first resource;

receiving, from a second device within the network, a second domain name service (DNS) request for an address of a second resource outside the network;

determining that the second resource is not associated with a security policy of the network that specifies decrypting encrypted traffic between the second device with the network and the second resource;

responsive to the determination that the second resource is not associated with a security policy of the network that specifies decrypting encrypted traffic between the second device and the second resource, sending, to the DNS, the second DNS request;

receiving, from the DNS, a DNS response;

returning, to the second device within the network and in response to receiving the second DNS request, the second DNS request; and

establishing a third encrypted connection between the second device and the second resource, to facilitate encrypted communication traffic between the second device and the second resource.

2. The method of claim 1 , wherein the address of the first resource is determined by the gateway based on the address returned in the DNS response.

3. The method of claim 1 , wherein decrypting and inspecting the encrypted communication traffic includes blocking the encrypted communication traffic.

4. The method of claim 1 , the method further comprising selecting the gateway from a plurality of available devices within the network.

5. The method of claim 4 , wherein the gateway is selected based on a comparison of the first resource with a rule defining destinations associated with encrypted communication traffic.

6. The method of claim 4 , wherein the gateway is selected based on hardware performance.

7. A non-transitory computer storage media encoded with computer program instructions that, when executed by one or more processors, cause a computer device to perform operations comprising:

receiving, from a device within a network, a domain name service (DNS) request for an address of a first resource outside the network;

determining that the first resource is associated with a security policy of the network that specifies decrypting encrypted traffic between the device within the network and the first resource;

responsive to the determination that the first resource is associated with a security policy of the network that specifies decrypting encrypted traffic between the device within the network and the first resource, returning, to the device within the network in response the DNS request, a DNS response comprising an address of a gateway within the network, the gateway address having previously been associated with the first resource address;

establishing a first encrypted connection between the device and the gateway, and a second encrypted connection between the gateway and the first resource, to facilitate encrypted communication traffic between the device and the first resource;

decrypting, by the gateway, all of the encrypted communication traffic passing between the device and the first resource such that all of the encrypted communication traffic passing between the device and the first resource is available to the gateway for inspection; and

inspecting at least some of the encrypted communication traffic passing between the device and the first resource;

receiving, from a second device within the network, a second domain name service (DNS) request for an address of a second resource outside the network;

determining that the second resource is not associated with a security policy of the network that specifies decrypting encrypted traffic between the second device with the network and the second resource;

responsive to the determination that the second resource is not associated with a security policy of the network that specifies decrypting encrypted traffic between the second device and the second resource, sending, to the DNS, the second DNS request;

receiving, from the DNS, a DNS response;

returning, to the second device within the network and in response to receiving the second DNS request, the second DNS request; and

establishing a third encrypted connection between the second device and the second resource, to facilitate encrypted communication traffic between the second device and the second resource.

8. The computer storage media of claim 7 , wherein the address of the first resource is determined by the gateway based on the address returned in the DNS response.

9. The computer storage media of claim 7 , wherein decrypting and inspecting the encrypted communication traffic includes blocking the encrypted communication traffic.

10. The computer storage media of claim 7 , wherein the operations further comprise selecting the gateway from a plurality of available devices within the network.

11. The computer storage media of claim 10 , wherein the gateway is selected based on a comparison of the first resource with a rule defining destinations associated with encrypted communication traffic.

12. The computer storage media of claim 10 , wherein the gateway is selected based on hardware performance.

13. A system comprising:

one or more processors configured to execute computer program instructions; and

non-transitory computer storage media encoded with computer program instructions that, when executed by one or more processors, cause a computer device to perform operations comprising:

receiving, from a device within a network, a domain name service (DNS) request for an address of a first resource outside the network;

determining that the first resource is associated with a security policy of the network that specifies decrypting encrypted traffic between the device within the network and the first resource;

responsive to the determination that the first resource is associated with a security policy of the network that specifies decrypting encrypted traffic between the device within the network and the first resource, returning, to the device within the network in response the DNS request, a DNS response comprising an address of a gateway within the network, the gateway address having previously been associated with the first resource address;

establishing a first encrypted connection between the device and the gateway, and a second encrypted connection between the gateway and the first resource, to facilitate encrypted communication traffic between the device and the first resource;

decrypting, by the gateway, all of the encrypted communication traffic passing between the device and the first resource such that all of the encrypted communication traffic passing between the device and the first resource is available to the gateway for inspection; and

inspecting at least some of the encrypted communication traffic passing between the device and the first resource;

receiving, from a second device within the network, a second domain name service (DNS) request for an address of a second resource outside the network;

determining that the second resource is not associated with a security policy of the network that specifies decrypting encrypted traffic between the second device with the network and the second resource;

responsive to the determination that the second resource is not associated with a security policy of the network that specifies decrypting encrypted traffic between the second device and the second resource, sending, to the DNS, the second DNS request;

receiving, from the DNS, a DNS response;

returning, to the second device within the network and in response to receiving the second DNS request, the second DNS request; and

establishing a third encrypted connection between the second device and the second resource, to facilitate encrypted communication traffic between the second device and the second resource.

14. The system of claim 13 , wherein the address of the first resource is determined by the gateway based on the address returned in the DNS response.

15. The system of claim 13 , wherein decrypting and inspecting the encrypted communication traffic includes blocking the encrypted communication traffic.

16. The system of claim 13 , wherein the operations further comprise selecting the gateway from a plurality of available devices within the network.

17. The system of claim 16 , wherein the gateway is selected based on a comparison of the first resource with a rule defining destinations associated with encrypted communication traffic.

18. The system of claim 16 , wherein the gateway is selected based on hardware performance.