Open main menu

Wikipedia β

DNS over HTTPS (DoH) is an experimental protocol for performing remote Domain Name System (DNS) resolution via the HTTPS protocol. The goal of the method is to increase user privacy and security by preventing eavesdropping and manipulation of DNS data by man-in-the-middle attacks.[1] As of March 2018, Google and the Mozilla Foundation are testing versions of DNS over HTTPS.[2][3]

In addition to improving security, another goal of DNS over HTTPS is to improve performance: testing of ISP DNS resolvers has shown that they have surprisingly slow response times in many cases, a problem that can be multiplied further by the need to resolve many addresses to deliver a single service such as a web page load.[1]

Google's publicly-implemented version of this protocol uses HTTP GET commands (over HTTPS) to access DNS information using an encoding of DNS query and result parameters represented in JSON notation.[2]

Another similar specification is in Internet-Draft status under the auspices of the IETF. This version of the protocol uses HTTP/2 and HTTPS, and the initial version supports the "wire format" DNS response data, as returned in existing UDP responses, in an HTTPS payload with the application/dns-message MIME type.[1][4] If HTTP/2 is used, the server may also use HTTP/2 server push to send values that it anticipates the client may find useful in advance.[4]

Contents

Implementation scenariosEdit

DNS over HTTPS is used for recursive DNS resolution by DNS resolvers. Resolvers (DoH clients) need to have access to a DoH server hosting a query endpoint.[4]

DNS over HTTPS currently lacks native support in operating systems. Thus a user whishing to use it must install additional software. Three usage scenarios are common:

  • Installing a DoH proxy on the name server in the local network: In this scenario client systems continue to use traditional (unencrypted) DNS to query the name server in the local network, who will then gather the necessary replies via DoH by reaching DoH-servers in the Internet. This method is transparent to the end-user.
  • Installing a DoH proxy on a local system: In this scenario, operating systems are configured to query a locally running DoH proxy. In contrast to the previously mentioned method, the proxy needs to be installed on each system whishing to use DoH, which might make a lot of effort necessary in larger environments.
  • Using a DoH implementation within an application: Some browser have a built-in DoH implementation and can thus perform queries by bypassing the operating systems DNS functionality. Effort is necessary to ensure that applications are properly configured. A drawback is that misconfigurations can lead to skipping of DoH querying without the end-user noticing it.

Please note that DoH does not provide any means to directly query an Authoritative name server. As such it must be assumed that the DoH server uses traditional (unencrypted) queries to finally reach authoritative servers. Thus DoH does not qualify as an End-to-end Encryption method.

DNS over HTTPS - Public DNS ServersEdit

DNS over HTTPS server implementations are already available for free by some public DNS providers[5]. See Public recursive name server for an overview.

Client supportEdit

  • Firefox since Version 60 and later — Browser support.[6]
  • DNSCrypt-proxy — Local DNS → DNS over HTTPS proxy.[7]
  • doh-php-client — PHP Implementation.[8]
  • Technitium DNS Client — C# .NET cross-platform implementation.[9]

AlternativesEdit

See alsoEdit

ReferencesEdit

  1. ^ a b c Chirgwin, Richard (14 Dec 2017). "IETF protects privacy and helps net neutrality with DNS over HTTPS". The Register. Retrieved 2018-03-21. 
  2. ^ a b "DNS-over-HTTPS | Public DNS | Google Developers". Google Developers. Retrieved 2018-03-21. 
  3. ^ Cimpanu, Catalin (2018-03-20). "Mozilla Is Testing "DNS over HTTPS" Support in Firefox". BleepingComputer. Retrieved 2018-03-21. 
  4. ^ a b c Hoffman, P; McManus, P. "draft-ietf-doh-dns-over-https-08 - DNS Queries over HTTPS". datatracker.ietf.org. Retrieved 2018-05-20. 
  5. ^ "DNS over HTTPS Implementations". 2018-04-27. Retrieved 2018-04-27. 
  6. ^ "Improving DNS Privacy in Firefox". 
  7. ^ "DNSCrypt-proxy v2.0". 
  8. ^ "DNS over HTTPS PHP Client". 
  9. ^ "DNS over HTTPS C# Client". 

External linksEdit