A relatively new technique called DNS over HTTPS (DoH) encrypts domain name system communication by routing DNS requests through an encrypted Hypertext Transfer Protocol Secure session. By concealing DNS inquiries, DoH aims to increase online privacy.

DoH functions similarly to DNS. However, HTTPS sessions save the requests and reduce the amount of data transferred when making inquiries. The privacy and security of user data can be improved by using encrypted DoH with web browsers like Mozilla’s Firefox, Microsoft’s Edge, and Google’s Chrome.

How Does DoH Operate?

It is first required to comprehend how standard DNS functions to comprehend how DoH functions. Every web server or website on a server has an associated Internet Protocol (IP) address, where websites are housed. DNS is crucial since a browser must know a website’s IP address to visit it.

When users type a hostname into their browser, a recursive resolver receives the request and, if unable to resolve the query itself, forwards it to a root name server. Top-level domains like.com,.org, and.edu are managed by a root name server. The resolver receives the address of the relevant top-level DNS server from the root server. The root DNS would provide the IP for the server that manages the top-level domain server, for instance, if the user were attempting to reach a .com website.

Now that the top-level domain server has received the resolver’s request, it can react by providing the IP address of the DNS server responsible for the requested domain. The DNS server receives the request from the resolver and responds with the user’s requested website’s IP address. The browser can send an HTTP or HTTPS request to that IP address to access the website the user requested. Although there are occasions when caching makes this process faster, this is essentially how standard DNS functions.

Although there are two significant changes, DoH functions essentially the same. The first and most noticeable distinction is that, as opposed to the previous practice, the browser now makes HTTPS requests for the DNS records rather than the other way around. These queries use port 443, much as HTTPS web traffic. Notably, DoH requires support from both the DNS server and the browser to function.

DoH tries to reduce the amount of data transmitted throughout the various DNS queries, another important distinction between it and normal DNS. Instead of providing the entire domain name that the user’s browser attempts to resolve, it accomplishes this by just broadcasting the piece of the domain name required to complete the current stage in the name resolution process. For instance, the DNS root doesn’t need to be aware of the user’s browser’s attempt at resolution. It merely needs to be aware that a .com URL is being tried to be resolved by the browser.

The Advantages of DoH

The use of DNS via HTTPS has several potential advantages. The main advantage is that DNS name resolution traffic encryption makes it easier to conceal your online activities. A DNS query is often required when consumers enter a URL into their browser to convert the domain portion of the URL into an IP address. Even though it might be alluring to imagine that this name resolution request is sent straight to a DNS server, in reality, unless a DNS server is present on the local network, the name resolution request must travel through the network of the internet service provider and any routers that are situated in between the ISP and the DNS server.

Each of these hops has a copy of the name resolution request. This implies that an ISP may identify the precise websites accessed by merely keeping track of DNS name resolution requests. The DoH conceals the name resolution requests from the ISP and anyone monitoring intermediary networks. In addition, DoH assists in countering man-in-the-middle (MitM) and DNS spoofing attacks. To put it another way, nobody can tamper with the resolution request results to direct the user’s browser toward a phony website because the session between the browser and the DNS server is encrypted.

Controversy And Criticism

DNS over HTTPS has come under heavy fire. The majority of DNS data would be concentrated with Google, giving it control over the routing of internet traffic and access to vast amounts of consumer and competitor data, according to vocal opponents of DoH like Comcast.

DoH can cause issues for businesses as well. Businesses may monitor DNS requests to prevent access to harmful or inappropriate websites. Additionally, malware that tries to call home can occasionally be found via DNS monitoring. DoH creates security monitoring blind hole since it encrypts requests for name resolution.

DNS over HTTPS: What is it?

Domain name server data is transmitted via HTTPS connections using the internet security protocol known as DNS over HTTPS (also known as DoH).

The more secure HTTP version, the DNS protocol, can now be used with HTTPS connections, thanks to a new standard published by the IETF. It is also crucial to fully grasp the DNS to comprehend what DNS over HTTPS signifies. 

DNS over HTTPS Benefits

Now that DNS traffic connections are encrypted for the first time, consumers and businesses may enjoy more privacy and security thanks to the DNS over HTTPS protocol.

However, because the DoH protocol is still in its infancy, several businesses are reluctant to embrace it because of implementation and compatibility problems. Here are some advantages of switching to the DNS approach versus the HTTPS one if these are your worries.

• You have the opportunity to test how DoH will work with your networks beforehand and address any potential problems before the DoH protocol becomes the standard.
• Your firm can benefit from increased data security and improved privacy if implemented correctly.
• You are allowed to evaluate your DNS traffic filter’s compliance with DNS over HTTPS.
• Your suggestions could help all the software developers improve their offerings for your benefit.

DNS over HTTPS Limitations

• Your system admins may restrict queries, raise false-positive security flags, and other issues if they are unfamiliar with DoH and related security policies.
• Your DNS traffic filtering solution might no longer be functional if it hasn’t been able to integrate with DoH.

It may be useless if DoH integration issues have prevented you from using your DNS traffic filtering solution. However, once DoH becomes the norm, its advantages will far outweigh its current challenges.