{"id":36652,"date":"2019-10-31T22:12:57","date_gmt":"2019-10-31T19:12:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/lyubit-i-ne-lyubit-dns-over-https\/"},"modified":"2019-10-31T22:12:57","modified_gmt":"2019-10-31T19:12:57","slug":"lyubit-i-ne-lyubit-dns-over-https","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/lyubit-i-ne-lyubit-dns-over-https","title":{"rendered":"\u2018Houdt van en houdt niet van\u2019: DNS over HTTPS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

We examine opinions regarding the features of DNS over HTTPS, which have recently become a \"bone of contention\" among internet providers and browser developers.<\/p>\n

\"\u2018Houdt<\/a><\/noindex><\/a><\/noindex>
\n\/ Unsplash \/ Steve Halama<\/a><\/noindex><\/i><\/p>\n

Essence of the Disagreements<\/h2>\n

\nRecently major media outlets<\/a><\/noindex> en thematic platforms<\/a><\/noindex> (including Habr), frequently write about the DNS over HTTPS (DoH) protocol. It encrypts requests to the DNS server and the responses to those requests. This approach allows users' hostnames to be concealed. From the publications, it can be concluded that the new protocol (approved by IETF in 2018)<\/a><\/noindex> has divided the IT community into two camps.<\/p>\n

Half believe that the new protocol will enhance internet security and are implementing it in their applications and services. The other half is convinced that the technology only complicates the work of system administrators. Next, we will analyze the arguments from both sides. <\/p>\n

How DoH Works<\/h2>\n

\nBefore discussing why internet providers and other market participants support or oppose DNS over HTTPS, let's briefly review its operational principles.<\/p>\n

In the case of DoH, the request for the IP address definition is encapsulated in HTTPS traffic. It then goes to the HTTP server, where it is processed via API. Here's an example of a request from RFC 8484 (p.6<\/a><\/noindex>):<\/p>\n

   :method = GET\n   :scheme = https\n   :authority = dnsserver.example.net\n   :path = \/dns-query?\n           dns=AAABAAABAAAAAAAAAWE-NjJjaGFyYWN0ZXJsYWJl\n           bC1tYWtlcy1iYXNlNjR1cmwtZGlzdGluY3QtZnJvbS1z\n           dGFuZGFyZC1iYXNlNjQHZXhhbXBsZQNjb20AAAEAAQ\n   accept = application\/dns-message\n<\/code><\/pre>\n
\nThus, DNS traffic is hidden within HTTPS traffic. The client and server communicate over the standard port 443. As a result, requests to the domain name system remain anonymous.<\/p>\n
Why It Is Not Well-Received<\/h2>\n
\nOpponents of DNS over HTTPS wordt gezegd<\/a><\/noindex>, argue that the new protocol will reduce the security of connections. According to woord<\/a><\/noindex> Paul Vixie, a member of the DNS development team, it will be harder for system administrators to block potentially harmful sites. Regular users will lose the ability to set up parental controls in their browsers.<\/p>\n
Paul's opinion is shared by internet providers in the UK. The country's legislation requires<\/a><\/noindex> them to block resources with prohibited content. However, support for DoH in browsers complicates the task of traffic filtering. Among the critics of the new protocol are the Government Communications Headquarters (GCHQ<\/a><\/noindex>) and the Internet Watch Foundation (IWF<\/a><\/noindex>), which maintains a registry of blocked resources.<\/p>\n
In our blog on Habr:<\/b><\/p>\n