Understanding DoT and DoH: Securing DNS in the Modern Era

In today’s increasingly digital world, securing online communication has become paramount. Among the lesser-discussed but critical areas of internet security is the domain of DNS (Domain Name System) queries, which resolve human-readable domain names into IP addresses. Historically, these queries have been transmitted in plain text, exposing users to various security risks like eavesdropping, manipulation, and spoofing. Enter DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH), two protocols designed to enhance the privacy and security of DNS traffic.

This blog delves into the technical details, comparisons, and implications of DoT and DoH.

DNS: The Foundation of Internet Navigation

The DNS functions as the phonebook of the internet, translating domain names (e.g., example.com) into IP addresses (e.g., 192.0.2.1). This process is fundamental for browsing the web, sending emails, and virtually any online activity.

However, traditional DNS queries and responses are transmitted unencrypted over UDP port 53. This lack of encryption exposes users to threats like:

• Man-in-the-Middle Attacks (MitM): Intercepting DNS queries to redirect users to malicious websites.
• Data Leakage: Allowing ISPs and third parties to monitor users’ web activity.
• DNS Spoofing and Poisoning: Manipulating responses to direct users to fake websites.

Introducing DoT and DoH

Both DoT and DoH aim to encrypt DNS traffic, shielding it from prying eyes and malicious actors. While they share similar objectives, they differ in implementation and use cases.

DNS-over-TLS (DoT)

DoT is a protocol that encrypts DNS queries using Transport Layer Security (TLS). It operates over a dedicated port, typically TCP port 853.

• How It Works:
  • A client initiates a TCP connection to a DNS server.
  • A TLS handshake establishes a secure connection.
  • DNS queries and responses are exchanged within this encrypted channel.
• Key Features:
  • Dedicated Port: Use of a specific port (853) makes it easy to identify and block if desired.
  • Encryption Standard: Provides strong encryption using the same protocols as HTTPS.
  • Compatibility: Works well in environments where DNS traffic management is critical (e.g., corporate networks).

DNS-over-HTTPS (DoH)

DoH encrypts DNS queries by tunneling them through HTTP/2 or HTTP/3 protocols, leveraging the same infrastructure used for regular HTTPS traffic. It typically operates over TCP/443.

• How It Works:
  • A DNS query is encapsulated within an HTTP request.
  • The request is sent to a DoH-compatible DNS server over an HTTPS connection.
  • The server resolves the query and sends the response within the encrypted HTTP connection.
• Key Features:
  • Shared Port: Uses the same port as regular HTTPS traffic (443), making it indistinguishable from other encrypted web traffic.
  • Integration: Can be seamlessly integrated into web browsers and applications.
  • Enhanced Privacy: Obfuscates DNS traffic among regular HTTPS traffic, improving privacy against network-level adversaries.

DoT vs. DoH: A Technical Comparison

Aspect	DNS-over-TLS (DoT)	DNS-over-HTTPS (DoH)
Encryption Protocol	TLS	HTTPS (HTTP/2 or HTTP/3 + TLS)
Port	TCP/853	TCP/443
Visibility	Easily identifiable as DNS traffic	Indistinguishable from other HTTPS traffic
Performance	Slightly faster due to less overhead	Slightly slower due to HTTP encapsulation
Adoption	Preferred for network-level controls	Preferred for individual application privacy
Configuration	Typically configured at the OS level	Often configured in browsers/apps

---

Security and Privacy Implications

1. Encryption: Both protocols prevent eavesdropping and manipulation of DNS queries.
2. Obfuscation: DoH offers greater privacy at the expense of potential overuse of HTTP/3 infrastructure, which might complicate network monitoring.
3. Resilience to Blocking: DoH traffic is harder to block due to its similarity to regular HTTPS traffic. DoT, with its dedicated port, can be more easily filtered.

Real-World Applications

DNS-over-TLS

• Enterprise Networks: Ensures encrypted DNS while maintaining visibility for monitoring and filtering.
• ISPs and Public DNS Services: Major providers like Google DNS and Cloudflare DNS support DoT for enhanced security.

DNS-over-HTTPS

• Browsers: Firefox and Chrome offer built-in support for DoH, emphasizing end-user privacy.
• Mobile Applications: Apps can directly route DNS queries through DoH to avoid reliance on the system’s DNS settings.

Challenges and Considerations

1. Performance Overhead: Both protocols introduce latency due to encryption, though modern infrastructure minimizes this impact.
2. Network Security Monitoring: DoH’s obfuscation can hinder legitimate monitoring and filtering in corporate environments.
3. Adoption Complexity: Configuring and maintaining encrypted DNS requires additional expertise and infrastructure.

Conclusion: Choosing Between DoT and DoH

The choice between DoT and DoH depends on the specific use case:

• Use DoT for environments that require clear network-level DNS management.
• Use DoH for maximum privacy and resilience against blocking.

Ultimately, both protocols represent significant advancements in DNS security, offering users the tools to protect their online activity against an evolving threat landscape. Adopting either protocol is a step forward in securing the foundational layers of internet communication.