10. Encrypted DNS

DNSSEC authenticates answers. It does not hide them. Every query you have ever made on port 53 was plaintext, visible to your network, your ISP and anyone on the path — and it is an unusually rich signal, because the name you look up reveals what you are about to do before you do it.

   WHAT PLAINTEXT DNS LEAKS
     every domain you visit, in order,
       with timing
     which apps you run (telemetry
       endpoints are distinctive)
     which devices are on the network
       (vendor-specific names)
     your approximate interests, health
       concerns, employer, bank

   AND IT IS TRIVIALLY MODIFIABLE
     ISP "search assistance" pages for
       NXDOMAIN
     national-scale blocking by DNS
     captive portals
     ad injection

The transports

   DO53     plain UDP/TCP port 53.
            the original. no encryption.

   DoT      DNS over TLS. RFC 7858.
            PORT 853. standard DNS
            messages inside a TLS stream.

   DoH      DNS over HTTPS. RFC 8484.
            PORT 443. a DNS message as an
            HTTP POST body or a
            base64url GET parameter.

   DoQ      DNS over QUIC. RFC 9250.
            PORT 853/udp. DNS messages over
            QUIC streams.

   ODoH     Oblivious DoH. RFC 9230.
            DoH through a relay that knows
            your IP but not your query,
            to a target that knows your
            query but not your IP.

   DNSCrypt pre-standard, still used by
            some resolvers. not an IETF
            protocol.

kdig +tls @1.1.1.1 example.com                    # DoT
kdig +https @1.1.1.1 example.com                  # DoH
curl -sH 'accept: application/dns-json' \
  'https://cloudflare-dns.com/dns-query?name=example.com&type=A' | jq
dog --tls example.com @1.1.1.1
resolvectl query --cache=no example.com

DoT versus DoH, operationally

   DoT  PORT 853
     + a distinct port, so it is easy to
       permit, measure and require
     + lower overhead than HTTP framing
     − EASY TO BLOCK. a firewall rule on
       853 forces fallback to plaintext.
     − needs explicit client support

   DoH  PORT 443
     + INDISTINGUISHABLE from web traffic.
       cannot be blocked without blocking
       HTTPS.
     + works through every proxy and
       captive portal that allows browsing
     + browsers can implement it without
       touching the OS
     − invisible to network operators,
       including the legitimate ones
     − HTTP framing overhead; needs HTTP/2
       or /3 to be efficient

The whole political argument about encrypted DNS is contained in that comparison. DoT is the version network operators can live with; DoH is the version that works regardless of what they want. Both encrypt the same bytes.

Note

DoH’s choice of port 443 was deliberate and contested. The IETF position was that a protocol which can be trivially blocked offers no protection to the people who need it most; the operator position was that it removes a layer of visibility they depend on for security and policy. Both are correct, which is why the argument has not ended.

What still leaks

Encrypting the query does less than it first appears, and being precise about this matters.

   STILL VISIBLE TO THE NETWORK

   1. THE IP YOU CONNECT TO AFTERWARDS.
      a DNS lookup for example.com is
      followed by a TCP connection to
      example.com's address. the
      destination IP is in every packet.

   2. THE TLS SNI, historically.
      the server name in plaintext in the
      ClientHello — until ECH.

   3. TIMING AND VOLUME.
      traffic analysis works on patterns.

   4. WHICH RESOLVER YOU USE.
      a connection to 1.1.1.1:853 is
      itself informative.

   THE PIECE THAT CLOSES THE GAP

   ECH — ENCRYPTED CLIENT HELLO
     the SNI encrypted with a public key
     published in DNS, in the `ech`
     parameter of an HTTPS/SVCB record.

   example.com. HTTPS 1 . alpn="h3,h2"
       ech="AED+DQA8AAAgAC…"

   SO: encrypted DNS + ECH + a shared IP
   (a CDN) = the destination is genuinely
   hidden. ANY ONE OF THE THREE MISSING
   AND IT IS NOT.

That dependency chain is why chapter 4’s HTTPS record matters beyond apex aliasing: ECH keys have to be distributed somehow, and DNS is the only channel available before the connection exists.

Oblivious DoH

   THE REMAINING PROBLEM WITH DoH: THE
   RESOLVER STILL SEES BOTH YOUR IP AND
   YOUR QUERIES.

   ODoH SPLITS THAT.

   client ──encrypted query──▶ RELAY
             (relay sees your IP,
              cannot read the query)
                                 │
                                 ▼
                              TARGET
             (reads the query, sees only
              the relay's IP)

   SECURITY RESTS ON THE RELAY AND TARGET
   NOT COLLUDING — which is a trust
   assumption, not a cryptographic
   guarantee.

Apple’s iCloud Private Relay and Cloudflare’s ODoH deployment are the production examples. The pattern is the same one Tor uses, applied to one protocol, with two hops instead of three and a much simpler threat model.

Who decides which resolver you use

This is where encrypted DNS becomes an operational problem rather than a protocol one.

   THE OLD ANSWER: DHCP told the OS, the OS
   told everything.

   THE NEW ANSWERS, ALL AT ONCE:

   THE OS            systemd-resolved,
                     Windows 11, Android
                     Private DNS, macOS
                     profiles — all support
                     DoT/DoH natively.

   THE BROWSER       Firefox shipped DoH to
                     Cloudflare by default
                     in the US in 2020.
                     Chrome uses "secure DNS"
                     with the user's existing
                     resolver if it supports
                     DoH.

   THE APPLICATION   any app can hardcode a
                     resolver. several do.

   AND DDR (RFC 9462) / DNR (RFC 9463)
     let a network ADVERTISE its own
     encrypted resolver, so a client can
     upgrade from Do53 to DoT/DoH with the
     SAME operator rather than a third
     party. this is the reconciliation.

# systemd-resolved
resolvectl status
grep -E 'DNSOverTLS|DNSSEC|DNS=' /etc/systemd/resolved.conf
# android: Settings → Network → Private DNS → hostname
# test a DoT endpoint
kdig +tls-host=dns.example.com @10.0.0.1 example.com

DDR is the development worth watching: it means a corporate or home network can offer encryption and keep its own resolver, which removes most of the operator objection without giving up the privacy gain.

Enterprise and split-horizon reality

   WHY A CORPORATE NETWORK CARES

   − INTERNAL NAMES. db.internal only
     resolves on the corporate resolver.
     a laptop using DoH to 1.1.1.1 gets
     NXDOMAIN and the VPN appears broken.

   − SECURITY MONITORING. DNS logs are the
     cheapest and most effective malware
     and exfiltration signal there is.
     DNS tunnelling is a real technique.

   − POLICY. content filtering,
     safe-search enforcement, blocking
     known-malicious domains.

   THE ANSWERS, IN ORDER OF HOW WELL THEY
   WORK

   1. RUN YOUR OWN DoH/DoT ENDPOINT and
      configure clients to it (MDM, Group
      Policy, Android Private DNS).
   2. ADVERTISE IT WITH DDR/DNR.
   3. BLOCK use-application-dns.net —
      the canary domain; returning
      NXDOMAIN for it tells Firefox to
      leave DoH off.
   4. BLOCK PORT 853 and known DoH
      endpoint IPs. a treadmill, and it
      loses.

# the Firefox canary: NXDOMAIN here disables its automatic DoH
dig use-application-dns.net

Caution

Blocking encrypted DNS by IP is a losing strategy and it degrades user experience in ways that look like unrelated faults — a laptop that works at home and fails at the office, or a phone that intermittently cannot resolve internal names. Providing a good encrypted resolver and advertising it is strictly better than fighting the clients.

DNS tunnelling, and the reason resolvers get watched

Encrypted DNS removes a security control, and it is worth knowing what that control was actually catching.

   DNS IS A BIDIRECTIONAL CHANNEL THAT
   ALMOST EVERY NETWORK ALLOWS.

   EXFILTRATION
     base32-encode the data into a
     subdomain:
     aGVsbG8gd29ybGQ.exfil.attacker.com
     every lookup delivers 100–200 bytes
     to a server the attacker controls.

   COMMAND AND CONTROL
     the reply's TXT record carries
     instructions back.

   TOOLS: iodine, dnscat2, dns2tcp,
   Cobalt Strike's DNS beacon.

   WHAT IT LOOKS LIKE IN LOGS
     very long labels
     high entropy in subdomain names
     a single domain with thousands of
       unique subdomains
     a steady, low-volume query rate from
       one host
     TXT queries from a host that has no
       business making them

# the shape of the detection, in one line
awk '{print $NF}' query.log | rev | cut -d. -f1,2 | rev   | sort | uniq -c | sort -rn | head

This is the legitimate core of the enterprise objection in this chapter: the detection above requires seeing the queries, and a client using DoH to a third party is invisible to it. Running your own encrypted resolver preserves both properties at once, which is why chapter 15 recommends it over blocking.

Choosing a public resolver, if you use one

   1.1.1.1  Cloudflare. no ECS by design.
            24-hour log retention claim.
            1.1.1.2 blocks malware;
            1.1.1.3 adds family filtering.

   8.8.8.8  Google. sends ECS, so CDN
            geo-routing is accurate.
            the largest, and the most
            thoroughly measured.

   9.9.9.9  Quad9. blocks known-malicious
            domains by default, validates
            DNSSEC, Swiss foundation, no
            ECS.

   AND THE TRADE IS ALWAYS THE SAME:
   accuracy of CDN steering (ECS) against
   handing your /24 to every domain you
   look up.

Measured differences in resolution latency between the three are small and vary by region; measured differences in what they do with the data are the thing actually worth choosing on.

EDNS Client Subnet, and the privacy it gives back

   ECS (RFC 7871): a resolver tells the
   authoritative server the CLIENT'S subnet,
   so geo-based answers can be accurate.

   dig +subnet=203.0.113.0/24 example.com

   WHY IT EXISTS
     a user in Tokyo using 8.8.8.8 would
     otherwise be geolocated to whichever
     Google PoP answered. ECS fixes CDN
     routing.

   WHAT IT COSTS
     every authoritative server for every
     domain you visit learns your /24.
     after all the work above.

   WHO SENDS IT
     8.8.8.8 does, by default.
     1.1.1.1 DOES NOT, as a policy choice.

The tension is real and unresolved: ECS makes CDN selection work properly and hands your approximate location to every domain you look up. Cloudflare’s refusal to send it, and Google’s decision to, are both defensible, and the practical consequence is that CDN geo-routing is slightly worse for 1.1.1.1 users.

What to take from this chapter

• Plaintext DNS leaks every domain you visit, in order, with timing, and is trivially modified for blocking and injection. That is the problem all of this solves.
• DoT (port 853) is easy to permit and easy to block; DoH (port 443) is indistinguishable from web traffic and cannot be blocked without blocking HTTPS. The political argument is entirely that difference.
• Encrypting the query leaves the destination IP, the TLS SNI, timing and your choice of resolver visible.
• ECH closes the SNI gap, and its keys are distributed in the ech parameter of an HTTPS/SVCB record — so DNS is the delivery channel for the thing that hides DNS’s consequence. Encrypted DNS plus ECH plus a shared CDN IP hides the destination; any one missing and it does not.
• ODoH splits the observer: a relay sees your IP but not your query, a target sees your query but not your IP. The guarantee rests on non-collusion, which is a trust assumption.
• Resolver choice is now contested between the OS, the browser and individual applications. DDR/DNR (RFC 9462/9463) is the reconciliation: a network advertises its own encrypted resolver so clients upgrade without switching operators.
• Enterprises care for three legitimate reasons: internal names, DNS logs as a security signal, and policy enforcement. The good answer is to run and advertise your own DoH/DoT endpoint, not to block.
• The use-application-dns.net canary disables Firefox’s automatic DoH when it returns NXDOMAIN. Blocking by IP is a treadmill that loses and produces faults that look unrelated.
• EDNS Client Subnet makes CDN geo-routing accurate and hands your /24 to every authoritative server you touch. Google sends it; Cloudflare refuses on principle.

Next: DNS as service discovery — round-robin, GeoDNS, anycast, SRV, and what Kubernetes and Consul actually do with all this.