DNS over HTTPS

Many government agencies and multinationals alike have repeatedly fallen victim to hacking, but little to nothing has been done to fix the problem once and for all.

There is no silver bullet. In matters of cyber security, a so-called solution can only offer a time-limited value. Cyber security threats are always evolving. Cyber criminals never stand still. You have to keep shooting your silver bullets if you even happen to have them.

DNS-over-HTTPS protocol (IETF RFC8484) (DoH for short) is such a solution to the pressing cyber security problem of unencrypted communications. It was designed by the Internet Engineering Task Force, Google, Mozilla and others.

DNS versus DNS over HTTPs

Actually, DoH sounds like something of an overkill. After all, HTTPs connections are encrypted already, so why bother implementing DNS over HTTPS?

DoH works by sending DNS requests via an encrypted HTTPS tunnel instead of using a classic plaintext UDP request.

Wait, there is more to it. DoH is not just encrypted, it works on the app level instead of the OS level. The idea behind DoH is to use DNS-over-HTTPS connections between an app (e.g. a browser or a mobile app) and an encrypted  DoH-compatible DNS server, called a resolver.

The complete DoH-traffic relies exclusively on HTTPS without any exceptions. That’s the beauty of the DoH concept.

All DoH domain name queries are encrypted and then camouflaged in regular web traffic, which is in turn sent to the DoH-compliant DNS-resolver. The latter one replies with a domain name’s IP address over HTTPS.

Don’t trust the Operating System

While open source operating systems like Linux, BSD or Solaris are designed to be highly secure, commercial off-the-shelf operating systems like Windows and macOS usually don’t hold a candle to the standards of enterprise-grade security. As a house owner you wouldn’t secure just the front and the garage doors while keeping the side doors wide open. But that’s how commercial operating systems nowadays work.

Cyber security in commercial operating systems is only skin-deep. Where no one is looking, security is usually non-existent.

As a result of the DoH-design, apps can re-gain control of DNS queries from intentionally half-baked operating systems by hard-wiring a list of trusted DNS-over-HTTPS servers (resolvers). This way, you can set up a list of your own trusted IPs with trustworthy resolvers.

DNS-over-HTTPS is gaining steam

The list of cyber security mishaps reads like the Who is Who of the IT industry and government. No one seems immune. DoH is one way you can regain a bit of security.