Jump to content

DNS over HTTPS: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
Mcbobhall (talk | contribs)
10 edits
→‎Criticism: Updated with latest decision from the UK ISPA.
→‎Client support: added AdGuard with proof
Line 22: Line 22:


== Client support ==
== Client support ==
* [[AdGuard]] for Android, AdGuard for iOS and AdGuard Home<ref>{{cite news |last1=Davenport |first1=Corbin |title=AdGuard officially releases its own DNS service, and it works with Android Pie |url=https://www.androidpolice.com/2018/12/29/adguard-officially-releases-its-own-dns-service-and-it-works-with-android-pie/ |accessdate=2019/08/01 |work=Android Police |publisher=Illogical Robot LLC, |date=2018/12/29}}</ref>
* Cloudflare 1.1.1.1 client app for Android and iOS.<ref>{{Cite web|url=https://www.zdnet.com/article/cloudflare-launches-android-and-ios-apps-for-its-1-1-1-1-service/|title=Cloudflare launches Android and iOS apps for its 1.1.1.1 service|last=Cimpanu|first=Catalin|website=ZDNet|language=en|access-date=2018-12-13}}</ref>
* Cloudflare 1.1.1.1 client app for Android and iOS.<ref>{{Cite web|url=https://www.zdnet.com/article/cloudflare-launches-android-and-ios-apps-for-its-1-1-1-1-service/|title=Cloudflare launches Android and iOS apps for its 1.1.1.1 service|last=Cimpanu|first=Catalin|website=ZDNet|language=en|access-date=2018-12-13}}</ref>
* Cloudflare resolver for Linux, MacOS and Windows.<ref>{{cite web |title=DNS over HTTPS |url=https://developers.cloudflare.com/argo-tunnel/reference/doh/ |website=Argo Tunnel |publisher=Cloudflare |accessdate=20 July 2019}}</ref>
* Cloudflare resolver for Linux, MacOS and Windows.<ref>{{cite web |title=DNS over HTTPS |url=https://developers.cloudflare.com/argo-tunnel/reference/doh/ |website=Argo Tunnel |publisher=Cloudflare |accessdate=20 July 2019}}</ref>

Revision as of 17:00, 1 August 2019

Internet security
protocols
Key management
Application layer
Domain Name System
Internet Layer

DNS over HTTPS (DoH) is a protocol for performing remote Domain Name System (DNS) resolution via the HTTPS protocol. A goal of the method is to increase user privacy and security by preventing eavesdropping and manipulation of DNS data by man-in-the-middle attacks.[1] As of March 2018, Google and the Mozilla Foundation are testing versions of DNS over HTTPS.[2][3]

In addition to improving security, another goal of DNS over HTTPS is to improve performance: testing of ISP DNS resolvers has shown that many often have slow response times, a problem that is exacerbated by the need to potentially have to resolve many hostnames when loading a single web page.[1]

Technical detail

DNS over HTTPS is a proposed standard, published as RFC 8484 (October 2018) by the IETF. It uses HTTP/2 and HTTPS, and supports the wire format DNS response data, as returned in existing UDP responses, in an HTTPS payload with the MIME type application/dns-message.[1][4] If HTTP/2 is used, the server may also use HTTP/2 server push to send values that it anticipates the client may find useful in advance.[5]

Implementation scenarios

DNS over HTTPS is used for recursive DNS resolution by DNS resolvers. Resolvers (DoH clients) must have access to a DoH server hosting a query endpoint.[5]

DNS over HTTPS lacks native support in operating systems. Thus, a user wishing to use it must install additional software. Three usage scenarios are common:

  • Using a DoH implementation within an application: Some browsers have a built-in DoH implementation and can thus perform queries by bypassing the operating system's DNS functionality. A drawback is that an application may not inform the user if it skips DoH querying, either by misconfiguration or lack of support for DoH.
  • Installing a DoH proxy on the name server in the local network: In this scenario client systems continue to use traditional (port 53 or 853) DNS to query the name server in the local network, which will then gather the necessary replies via DoH by reaching DoH-servers in the Internet. This method is transparent to the end user.
  • Installing a DoH proxy on a local system: In this scenario, operating systems are configured to query a locally running DoH proxy. In contrast to the previously mentioned method, the proxy needs to be installed on each system wishing to use DoH, which might require a lot of effort in larger environments.
  • Installing a DoH resolving plugin for the operating system

In all of these scenarios, the DoH client does not directly query any authoritative name servers. Instead, the client relies on the DoH server using traditional (port 53 or 853) queries to finally reach authoritative servers. Thus DoH does not qualify as an end-to-end encrypted protocol, only hop-to-hop encrypted and only if DNS over TLS is used consistently.

Public DNS servers using DoH

DNS over HTTPS server implementations are already available for free by some public DNS providers[6]. See Public recursive name server for an overview.

Client support

  • AdGuard for Android, AdGuard for iOS and AdGuard Home[7]
  • Cloudflare 1.1.1.1 client app for Android and iOS.[8]
  • Cloudflare resolver for Linux, MacOS and Windows.[9]
  • cURL since 7.62.0.[10]
  • DNSCrypt-proxy — Local DNS → DNS over HTTPS proxy.[11]
  • DNSP — Versatile DNSProxy. DoH server (C) and client (PHP) implementation.[12]
  • doh-php-client — PHP Implementation.[13]
  • Firefox since Version 62 and later — Browser support.[14]
  • Intra — an Android application by Jigsaw to route your DNS queries to a DNS-over-HTTPS server of your choice.[15]
  • nss-tls — a DoH-based resolver plugin for glibc.[16]
  • Technitium DNS Client — C# .NET cross-platform implementation.[17]
  • Technitium DNS Server — A local DNS server with DNS-over-HTTPS forwarder support.[18]
  • NextDNS client apps.[19]
  • Nebulo - DNS over HTTPS/TLS - for android.[20]

Criticism

The Internet Watch Foundation and the Internet Service Providers Association (ISPA)—a trade association representing UK ISPs, criticised Google and Mozilla for supporting DoH, as they believe that it will undermine web blocking programs in the country, including ISP default filtering of adult content, and mandatory court-ordered filtering of copyright violations. Mozilla responded to allegations by the latter (who nominated Mozilla as an "internet villain"), arguing that it would not prevent filtering, and that they were "surprised and disappointed that an industry association for ISPs decided to misrepresent an improvement to decades-old internet infrastructure".[21][22] On 9 July 2019, the ISPA withdrew Mozilla's "Internet Villain Nomination and Category."[23]

Alternatives

Alternatives to DNS over HTTPS are DNS over TLS, DNSCurve, and DNSCrypt.

See also

References

  1. ^ a b c Chirgwin, Richard (14 Dec 2017). "IETF protects privacy and helps net neutrality with DNS over HTTPS". The Register. Retrieved 2018-03-21.
  2. ^ "DNS-over-HTTPS | Public DNS | Google Developers". Google Developers. Retrieved 2018-03-21.
  3. ^ Cimpanu, Catalin (2018-03-20). "Mozilla Is Testing "DNS over HTTPS" Support in Firefox". BleepingComputer. Retrieved 2018-03-21.
  4. ^ Hoffman, P; McManus, P. "RFC 8484 - DNS Queries over HTTPS". datatracker.ietf.org. Retrieved 2018-05-20.
  5. ^ a b Hoffman, P; McManus, P. "draft-ietf-doh-dns-over-https-08 - DNS Queries over HTTPS". datatracker.ietf.org. Retrieved 2018-05-20.
  6. ^ "DNS over HTTPS Implementations". 2018-04-27. Retrieved 2018-04-27.
  7. ^ Davenport, Corbin (2018/12/29). "AdGuard officially releases its own DNS service, and it works with Android Pie". Android Police. Illogical Robot LLC,. Retrieved 2019/08/01. {{cite news}}: Check date values in: |accessdate= and |date= (help)CS1 maint: extra punctuation (link)
  8. ^ Cimpanu, Catalin. "Cloudflare launches Android and iOS apps for its 1.1.1.1 service". ZDNet. Retrieved 2018-12-13.
  9. ^ "DNS over HTTPS". Argo Tunnel. Cloudflare. Retrieved 20 July 2019.
  10. ^ "DoH in curl".
  11. ^ "DNSCrypt-proxy v2.0".
  12. ^ "DNSP".
  13. ^ "DNS over HTTPS PHP Client".
  14. ^ "Improving DNS Privacy in Firefox".
  15. ^ "Intra on Play Store".
  16. ^ http://github.com/dimkr/nss-tls
  17. ^ "DNS over HTTPS C# Client".
  18. ^ "Technitium DNS Server as DNS-over-HTTPS Proxy".
  19. ^ "nextdns". www.nextdns.io. Retrieved 2019-07-13.
  20. ^ https://play.google.com/store/apps/details?id=com.frostnerd.smokescreen
  21. ^ Cimpanu, Catalin. "UK ISP group names Mozilla 'Internet Villain' for supporting 'DNS-over-HTTPS'". ZDNet. Retrieved 2019-07-05.
  22. ^ "Internet group brands Mozilla 'internet villain' for supporting DNS privacy feature". TechCrunch. Retrieved 2019-07-19.
  23. ^ "ISPA withdraws Mozilla Internet Villain Nomination and Category » News, Press Releases | The Internet Service Providers Association". Retrieved 2019-07-21.
Retrieved from "https://en.wikipedia.org/w/index.php?title=DNS_over_HTTPS&oldid=908884172"