Lead Image © Sergejus Bertasius, 123RF.com

Lead Image © Sergejus Bertasius, 123RF.com

Domain name resolution with DNS over HTTPS

Secure Paths

Article from ADMIN 53/2019
The new DNS over HTTPS standard from the Internet Engineering Task Force is meant to eliminate some of the known vulnerabilities of the Domain Name System.

Domain name system security extensions (DNSSEC) was meant to solve many of the known security problems in the domain name system (DNS) protocol, but it has not really taken off and is rarely used in practice, not least because of the DNS extension's complexity. For example, if you look at an end user, a recursive DNS request is usually made to the DNS resolver at the user's Internet service provider (ISP), because the browser itself does not know the IP address of a particular website.

The information presumably is not already stored locally or in a cache ISP-side, so the ISP takes care of responding to the DNS request and forwards it through various other DNS servers until the request arrives at the server that has a corresponding entry in its own DNS zone file, which allows it to answer the request. The response is then returned to the requesting DNS server, where it is cached for a certain period of time for further requests and is also sent to the requesting client.

Listing 1 shows a simplified example of how a DNS request ultimately reaches the DNS server responsible for a particular domain. Because the requests reach the DNS resolver in plain text, the resolver can log this information for later use. Whether the information is sold to interested customers or simply discarded is up to the operator of the DNS resolver. The DNS resolver from Google ( and, for example, logs various information either temporarily or permanently [1].

Listing 1

DNS Request

# dig +trace www.redhat.com
.            7743 IN NS h.root-servers.net.
.            7743 IN NS i.root-servers.net.
.            7743 IN NS j.root-servers.net.
com.                    172800 IN NS l.gtld-servers.net.
Use Express-Checkout link below to read the full article (PDF).

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy ADMIN Magazine

Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

comments powered by Disqus