{"id":36652,"date":"2019-10-31T22:12:57","date_gmt":"2019-10-31T19:12:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/lyubit-i-ne-lyubit-dns-over-https\/"},"modified":"2019-10-31T22:12:57","modified_gmt":"2019-10-31T19:12:57","slug":"lyubit-i-ne-lyubit-dns-over-https","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/lyubit-i-ne-lyubit-dns-over-https","title":{"rendered":"\"Loves and Doesn't Love\": DNS over HTTPS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

We analyze opinions regarding the features of DNS over HTTPS, which has recently become a \"bone of contention\" among internet providers and browser developers.<\/p>\n

\""Loves<\/a><\/noindex><\/a><\/noindex>
\n\/ Unsplash \/ Steve Halama<\/a><\/noindex><\/i><\/p>\n

The Essence of the Disagreements<\/h2>\n

\nRecently major media outlets<\/a><\/noindex> and thematic platforms<\/a><\/noindex> (including Habr) frequently write about the DNS over HTTPS (DoH) protocol. It encrypts DNS queries and responses. This approach hides the host names that users are requesting. From the publications, one can conclude that the new protocol (approved by the IETF in 2018)<\/a><\/noindex> has divided the IT community into two camps.<\/p>\n

Half believe that the new protocol will enhance internet security and are implementing it in their applications and services. The other half is convinced that the technology merely complicates the work of system administrators. Next, we will analyze both sides' arguments. <\/p>\n

How DoH Works<\/h2>\n

\nBefore discussing why internet providers and other market participants are for or against DNS over HTTPS, let's briefly summarize its principles.<\/p>\n

In the case of DoH, the request for determining an IP address is encapsulated in HTTPS traffic. It then goes to an HTTP server, where it is processed via an API. Here\u2019s an example request from RFC 8484 (p.6<\/a><\/noindex>):<\/p>\n

   :method = GET\n   :scheme = https\n   :authority = dnsserver.example.net\n   :path = \/dns-query?\n           dns=AAABAAABAAAAAAAAAWE-NjJjaGFyYWN0ZXJsYWJl\n           bC1tYWtlcy1iYXNlNjR1cmwtZGlzdGluY3QtZnJvbS1z\n           dGFuZGFyZC1iYXNlNjQHZXhhbXBsZQNjb20AAAEAAQ\n   accept = application\/dns-message\n<\/code><\/pre>\n
\nThus, DNS traffic is concealed within HTTPS traffic. The client and server communicate over the standard port 443. As a result, requests to the domain name system remain anonymous.<\/p>\n
Why It's Not Welcomed<\/h2>\n
\nOpponents of DNS over HTTPS say<\/a><\/noindex>argue that the new protocol will decrease the security of connections. According to words<\/a><\/noindex> Paul Vixie, a member of the DNS development team, it will be more difficult for system administrators to block potentially malicious sites. Regular users will lose the ability to set up conditional parental controls in browsers.<\/p>\n
Paul's opinion is shared by UK internet providers. The laws of the country require<\/a><\/noindex> them to block resources with prohibited content. However, support for DoH in browsers complicates the task of traffic filtering. Among the critics of the new protocol are also the UK's Government Communications Headquarters (GCHQ<\/a><\/noindex>) and the Internet Watch Foundation (IWF<\/a><\/noindex>), which maintains a registry of blocked resources.<\/p>\n
On our blog on Habr:<\/b><\/p>\n