DoH (DNS over HTTPS) and DoT

Unleashing the Web's Private Messenger: A Deep Dive into DoH and DoT

Ever feel like your internet service provider (ISP) is peering over your shoulder as you browse? Well, in a way, they are. Every time you type a website address into your browser, your device has to ask a "DNS server" for its IP address – kind of like looking up a phone number in a giant, public directory. And who controls that directory? Often, it's your ISP.

But what if there was a way to make those directory inquiries a whole lot more private? Enter DNS over HTTPS (DoH) and DNS over TLS (DoT). These clever technologies are the internet's answer to giving your browsing habits a much-needed cloak of privacy. Think of them as encrypted whispers for your web requests, ensuring that only you and the destination website know what you're up to.

In this in-depth exploration, we're going to demystify DoH and DoT, understand why they matter, and even get our hands dirty with some code. So, buckle up, grab your favorite beverage, and let's dive into the fascinating world of private DNS!

The Old Way: A Peekable Public Directory

Before we get to the fancy stuff, let's briefly revisit the "good old days" (or not-so-good, depending on your privacy stance) of traditional DNS.

When you type www.example.com into your browser:

1. Your device queries its configured DNS server (usually provided by your ISP).
2. This DNS server then looks up the IP address for www.example.com.
3. The IP address is returned to your device, which then connects to the website.

The problem? These DNS queries are sent in plain text. That means your ISP, or anyone snooping on your network, can see every website you're trying to visit. This can be used for:

• Tracking: Building profiles of your browsing habits for targeted advertising.
• Censorship: Blocking access to certain websites based on government requests or company policies.
• Malware Distribution: Redirecting you to malicious sites disguised as legitimate ones.

It's like leaving a trail of breadcrumbs for everyone to follow!

Enter the Guardians: DoH and DoT

DoH and DoT are essentially the same concept – encrypting your DNS queries – but they achieve it through different technical means. Think of them as two different security companies offering the same enhanced privacy service.

DNS over HTTPS (DoH): The "In Plain Sight" Approach

DoH piggybacks on the very protocol that powers the web: HTTPS. When you visit a secure website (one starting with https://), your browser establishes an encrypted connection. DoH does the same for your DNS queries.

How it works:

Instead of sending a DNS request to a dedicated DNS server in plain text, DoH wraps that request inside an HTTPS request. This means your DNS queries travel through the same encrypted tunnels as your website traffic, making them indistinguishable from regular web browsing to an outside observer.

Analogy: Imagine sending a postcard with your DNS request written on it. Anyone can read it. Now, imagine putting that postcard inside a sealed, opaque envelope (HTTPS) and sending it through the regular postal service. The postal service sees a sealed envelope, but they don't know what's inside.

DNS over TLS (DoT): The Dedicated Secure Channel

DoT, on the other hand, uses a different secure protocol: TLS (Transport Layer Security), the same protocol that secures HTTPS but typically used on a different port. It establishes a dedicated, encrypted connection specifically for DNS queries.

How it works:

Your device connects to a DoT-enabled DNS server over a secure TLS connection (usually on port 853). All DNS requests and responses are then encrypted and transmitted through this dedicated channel.

Analogy: This is like having a private, secure phone line directly to the directory assistance. No one else can tap into that line, and only you and directory assistance know the conversation.

Prerequisites: What Do You Need?

Before you can start enjoying the privacy benefits of DoH and DoT, a few things need to be in place:

1. A DoH/DoT-Compatible DNS Resolver: You need a DNS server that supports either DoH or DoT. Many public DNS providers now offer this service. Popular choices include:

   • Cloudflare DNS: 1.1.1.1 (DoH/DoT)
   • Google Public DNS: 8.8.8.8 (DoH/DoT)
   • Quad9: 9.9.9.9 (DoH/DoT)

2. A Device/Application That Supports DoH/DoT:

   • Modern Web Browsers: Chrome, Firefox, Edge, and Brave all have built-in support for DoH, and some are starting to implement DoT.
   • Operating System Support: Newer versions of Windows and macOS have increasing native support for encrypted DNS.
   • Router Support: Some advanced routers can be configured to use DoH/DoT for all devices on your network.
   • Third-Party Applications: Various DNS client applications can be installed on your system to enable DoH/DoT.

Unpacking the Good Stuff: Advantages of DoH and DoT

So, why should you care about these encrypted DNS protocols? The benefits are quite compelling:

• Enhanced Privacy: This is the big one! Your DNS queries are no longer an open book. This prevents your ISP, network administrators, and potentially malicious actors from easily tracking your browsing activity. Imagine browsing for sensitive information without feeling like you're being watched.
• Improved Security: Encrypting DNS queries can protect you from DNS spoofing attacks. In such attacks, a malicious actor could trick your device into connecting to a fake website by providing a false IP address. DoH and DoT make this much harder to achieve.
• Bypassing Censorship (with caveats): In regions with strict internet censorship, DoH and DoT can sometimes help bypass DNS-based blocking. By encrypting your requests, it becomes harder for censors to identify and block access to specific websites. However, it's important to note that this isn't a foolproof solution, and sophisticated censorship mechanisms can still identify and block encrypted traffic.
• Consistent Experience: When you travel or switch networks, your DNS settings can sometimes change, leading to inconsistent browsing experiences. Using a trusted DoH/DoT provider ensures a more consistent and predictable experience.
• Network Administrator Benefits: For organizations, DoH/DoT can help improve security and privacy for their users, ensuring that internal DNS queries are protected.

The Not-So-Shiny Side: Disadvantages and Considerations

While DoH and DoT offer significant advantages, they aren't a perfect solution for everyone. Here are some points to consider:

• Potential for Centralization: If everyone starts using a few major DoH/DoT providers (like Cloudflare or Google), it could lead to a centralization of DNS infrastructure. This might create new points of failure and give these large companies more influence over internet access.
• Performance Impact (Slight): While often negligible, the encryption and decryption process can introduce a very small overhead, potentially leading to a minor increase in latency. However, in practice, this is usually unnoticeable for most users.
• Troubleshooting Difficulties: When something goes wrong with your internet connection, traditional DNS can be easier to troubleshoot. With encrypted DNS, pinpointing the exact cause might be a bit more involved.
• ISP Monitoring: While DoH/DoT encrypt your DNS queries, your ISP can still see the IP addresses of the DoH/DoT servers you're connecting to. They can also see the volume of data you're transmitting.
• Trusting Your DNS Provider: Ultimately, you're shifting your trust from your ISP to your chosen DoH/DoT provider. It's crucial to choose reputable providers with strong privacy policies.
• Compatibility Issues: While becoming more widespread, not all older devices or applications natively support DoH or DoT.

Diving into the Features: How It All Works Under the Hood

Let's get a little more technical and see how these protocols are implemented.

DoH in Action: The Browser's Secret Agent

Many modern browsers allow you to enable DoH directly. Here's a peek at how it might look in Chrome (the exact steps might vary slightly with updates):

Chrome Settings for DoH:

1. Open Chrome.
2. Go to Settings (three vertical dots in the top right corner).
3. Navigate to Privacy and security > Security.
4. Scroll down to Advanced.
5. Under Use secure DNS, select With and choose your preferred DoH provider from the dropdown list or enter a custom one.

When you enable this, Chrome will send your DNS requests like this:

POST /dns-query HTTP/1.1
Host: 1.1.1.1.cloudflare-dns.com  # Example host for Cloudflare
Content-Type: application/dns-message

[Binary DNS query data]

This request is then wrapped in a TLS connection, just like any other HTTPS request.

DoT in Action: A Dedicated Secure Channel

DoT is often configured at the operating system level or through specialized DNS client applications.

Example with dnscrypt-proxy (a popular open-source tool):

dnscrypt-proxy allows you to configure your system to use DoT. You'd typically install it, edit its configuration file (dnscrypt-proxy.toml), and then point your system's DNS settings to dnscrypt-proxy's local listener.

Snippet from dnscrypt-proxy.toml:

server_names = ['cloudflare', 'google', 'quad9-tls'] # Example DoT servers
listen_addresses = ['127.0.0.1:53'] # Listening on localhost for your system

In this setup, dnscrypt-proxy acts as a local DNS server for your machine. When your system makes a DNS request, it goes to dnscrypt-proxy, which then forwards it securely using DoT to the specified upstream server.

The underlying communication would involve establishing a TLS connection on port 853 to the DoT server.

Choosing a DoH/DoT Provider: What to Look For

When selecting a DoH or DoT provider, consider these factors:

• Privacy Policy: Read their privacy policy carefully. Do they log your queries? How long do they retain logs? Do they sell data? Reputable providers will have clear, user-friendly privacy policies.
• Performance: Some providers might offer better performance in your region. Testing different providers can be beneficial.
• Features: Some providers offer additional features like parental controls or malware blocking.
• Trust and Reputation: Opt for well-established and trusted organizations.

Conclusion: Embracing a More Private Web

DoH and DoT are not just technical buzzwords; they represent a significant step forward in safeguarding our online privacy. By encrypting our DNS queries, we can reclaim a degree of anonymity and security that was previously difficult to achieve.

While they come with their own set of considerations, the benefits of enhanced privacy and security are increasingly important in today's digital landscape. Whether you choose the "in plain sight" security of DoH through your browser or the dedicated secure channel of DoT via your operating system or a dedicated client, embracing these technologies is a smart move towards a more private and secure internet experience.

So, go ahead, enable DoH or DoT on your devices. It's like giving your internet connection a secret handshake, ensuring that your online journey remains your business, and yours alone. The web is a vast and wonderful place, and with DoH and DoT, you can explore it with a little more peace of mind.