Techniques for an enhanced internal host detection protocol are disclosed. In some embodiments, a system, a process, and/or a computer program product for an enhanced internal host detection protocol includes sending a response to a get configuration query from a portal for a cloud security service to an endpoint agent; routing a DNS reverse lookup query to a predetermined IP address associated with a DNS proxy associated with the cloud security service; sending a response to the DNS reverse lookup query from the DNS proxy associated with the cloud security service; and verifying that the response to the DNS reverse lookup query is not spoofed based on a match with the response to the get configuration query.