Getty Images
Sponsor Content
How DoH Is Overcoming DNS Challenges
“One of the things about working in internet technology is nothing lasts forever… [Students] come to me and they say, ‘I want to do something that has an impact 20, 50, or 100 years from now.’ I say, well, maybe you should compose music because none of this technology stuff is going to be around that long. It all gets replaced.”
—Paul Mockapetris, co-inventor of the domain name system (DNS)
It would have been difficult for Paul Mockapetris to anticipate the DNS challenges we are dealing with today. As foresighted as he may have been, DNS inventor Mockapetris got one thing wrong in a retrospective interview about his contribution to internet history. Namely, some aspects of technology do have at least 20-year staying power. In this case, his own invention: the domain name system, or DNS.
But DNS, just three years shy of its 40th birthday, is on the cusp of a major reimagining–one that could enhance the privacy of business and private users alike for some time to come. According to some experts, it may even be worthy of the title “DNS 2.0.”
DNS Challenges Today
While DNS has evolved significantly in the more than 35 years since originally conceived, the skeletal structure remains much the same. DNS is the internet’s protocol for translating the URLs humans understand into the IP addresses machines do.
The problem is that this system never meant to consider privacy or security. With DNS today, requests are made and resolved in plain text, providing intrusive amounts of information to whomever may be resolving or inspecting them. That is most likely an ISP, but it may also be a government entity or some other source. In authoritarian countries, governments can use this information to prosecute individuals for visiting sites with outlawed content. In the United States, it’s more likely to be monetized for its advertising value.
“The problem with DNS is it exposes what you’re doing,” says Webroot product manager and DNS expert Jonathan Barnett. “If I can log a user’s DNS requests, I can see when they work, when they don’t, how often they use Facebook, the Sonos Speakers and Google Nests on their network, all of that. From a privacy perspective, it shows what on the internet is associating with me and my network.”
This can be especially problematic in terms of home routers. Whereas business networks tend to be relatively secure—patched, up-to-date and modern—”everyone’s home router tends to be set up by someone’s brother-in-law or an inexperienced ISP technician,” warns Barnett. In this case, malicious hackers can change DNS settings to redirect to their own resolvers.
“If you bring a device onto this network and try to navigate to one of your favorite sites, you may never wind up where you intended,” says Barnett.
In the age of COVID-19, DNS challenges are becoming an even bigger problem for employers. With a larger workforce working from home than perhaps ever before, traditional defenses at the network perimeter no longer remain.
“To maintain resilience,” says Barnett, “companies need to extend protection beyond the business network perimeter. One of the best ways to do that is through DNS protection that ensures requests are resolved through a trusted resolver and not a potentially misconfigured home network.”
DoH: The Second Coming of DNS
In response to these concerns, DNS over HTTPS (DoH) offers a method for encrypting DNS requests. Designed by the Internet Engineering Task Force, it leverages the HTTPS privacy standard to mask these
- Page 1
- Page 2
Note that before DoH there was already (DoT) DNS over TLS which solves all of the problems that DoH does in a slightly more direct way since it does not need the HTTP layer.
In theory DoH could work better than DoT in a HTTP/2 setting since it avoids problems resulting from having many queries share a single connection, but measurements have not shown this to be the case.
Probably the biggest appeal of DoH is that browser implementers are comfortable with HTTP… plus it adds the ability to make DNS traffic look like HTTP traffic, making it more difficult to filter or otherwise monitor for network administrators. While seemingly a “win” at first glance, there are various reasons to be nervous about this, and probably if a user feels that she needs such protections against the local network operator she should employ a full VPN. It also bypasses DNS-based protections which many admistrators use to protect their users from various malware and other abuse sites.
In addition to the concerns from a network operator view, there are potential privacy concerns with DoH, as web browser or mobile application developers may send user DNS traffic to a very small number of DoH resolvers (almost all browsers in use today are basically made by Google, Mozilla, Apple, and Microsoft). While this is not a necessary result of moving to DoH for DNS, it is at least a possibility that should be considered and guarded against.
I find it slightly disappointing that this somewhat breathless overview of DoH does not really present any of the potential issues with this new technology.