1. Encrypting DNS traffic
The why and the how
John Crain
Eastern Europe DNS Forum
4-5 December 2018

2. The Why
How did we get here?

3. DNS Traffic Interception
We know that parties actively intercept DNS traffic both for good and for bad
Good: See if you're about to go to a malicious site and catch you before you do.
Bad: snooping for various reasons.
Most traffic is now encrypted, why not start encrypting DNS traffic as well?

4. The How?
Options

5. Early solutions DNSCrypt came soon thereafter
DNSCurve proposed by Dan Bernstein in 2009
First introduction of Curve25519, replacement for Elliptical Curve Digital Signature Algorithm (ECDSA)
Did not catch on
DNSCrypt came soon thereafter
Got a little more adoption
Both were cryptographically sound, but neither was taken to the IETF for standardization

6. DNS over TLS (DoT)
Protects traffic from the stub resolver to the recursive resolver
Take the original DNS protocol and run it over Transport Layer Security (TLS) on a new port (port 853)
- Standardized in RFC 7858 (May 2016)
- Implemented in major recursive resolvers  
Very little uptake from the operating systems (Android is furthest ahead here)

7. DNS over HTTPs (DoH)
Protects traffic from the browser to the recursive resolver
It is DNS over HTTP over SSL/TLS (Port 443)
Allows all the normal HTTP semantics, caching, server push etc.
- RFC 8484, very recent (October 2018) - Code is already in Firefox, soon to be in Chrome, but not turned on by default   - Many DNS server implementations

8. DNS over HTTPs (DoH)
Uses the concept of Trusted Recursive Resolvers (TRR)
Configured in the browser
Browsers ship with default TRR
Firefox uses Cloudflare
(Not clear which TRR other browsers will choose)

9. It’s very new Still a lot of questions
As a business how to ensure your users are using the TRR you trust?
(Draft suggestion:
How do you distinguish DNS from other traffic? (443)

10. DoT vs DoH DNS over TLS DNS over HTTPs VS Uses a new dedicated port
Implemented in the DNS server software
Needs OS support
Uses current server provisioning (DHCP)
You can run a local DoT server
Uses the HTTPs port
Implemented in DNS server software
Needs Browser support
Servers currently specified in stub/browser config
You can run a local DoH server VS

11. Questions?
John’s Contact Info:
Skype: JohnLcrain
You can adjust the /web address to whichever or web address is best suited to your presentation. This should be your final slide.