DNS Over HTTPS (DoH): Benefits and Security Concerns in Modern Internet Infrastructure

DNS over HTTPS (DoH) represents a significant shift in how domain name resolution is handled across the internet, combining both privacy and security enhancements with the traditional function of the Domain Name System (DNS). As the internet becomes increasingly concerned with privacy protection and secure communication, DoH aims to address one of the more vulnerable aspects of internet infrastructure: the DNS query process. However, despite its benefits, the adoption of DoH also introduces a series of security concerns that need to be carefully considered by network administrators, cybersecurity professionals, and users alike.

At its core, DNS is the protocol responsible for resolving human-readable domain names (such as example.com) into their corresponding IP addresses (like 192.0.2.1), allowing users to access websites and services. Traditionally, DNS queries are sent in plaintext, meaning that anyone with access to the network path between a user and the DNS resolver—such as internet service providers (ISPs), network operators, or malicious attackers—can monitor, intercept, or manipulate these queries. This lack of encryption exposes users to various privacy risks, including surveillance and DNS hijacking, where attackers redirect users to malicious websites by manipulating DNS responses.

DoH was introduced to mitigate these risks by encrypting DNS queries, embedding them within HTTPS traffic, which is already widely used to secure web communication. By encrypting DNS queries and responses, DoH makes it much more difficult for third parties to monitor or tamper with DNS traffic. This encryption helps protect users’ browsing habits and online activities from being tracked by ISPs, government surveillance, or malicious actors on the same network, such as in public Wi-Fi environments. For privacy-conscious users and organizations, this is a significant advantage, as it prevents the easy interception of DNS queries and protects against certain types of man-in-the-middle (MitM) attacks.

One of the primary benefits of DoH is its ability to combat censorship and network surveillance. In many countries, governments or ISPs use DNS traffic to monitor and control access to specific websites. By blocking certain domain resolutions, they can prevent users from reaching particular websites, enforcing censorship policies. Since DoH hides DNS queries within encrypted HTTPS traffic, it becomes much harder for these entities to monitor what websites a user is attempting to access, allowing individuals to bypass restrictions more easily. This makes DoH a useful tool for activists, journalists, and users in oppressive regimes where internet censorship is a widespread issue. Moreover, because DoH uses the same ports as HTTPS traffic (typically port 443), it is more difficult for firewalls and network administrators to distinguish between standard web traffic and DNS queries, making it harder to selectively block or monitor DNS traffic.

In addition to privacy benefits, DoH can enhance security by providing protection against DNS spoofing and manipulation. In traditional DNS setups, because queries are transmitted in plaintext, attackers can intercept and alter DNS responses, redirecting users to malicious websites designed to look like legitimate ones. By encrypting the DNS queries, DoH reduces the chances of these types of attacks, as it makes it more difficult for attackers to see and manipulate the DNS traffic. For businesses and individuals who rely on secure, uninterrupted access to websites and services, this added layer of protection against DNS hijacking can be a significant advantage.

Despite these benefits, the adoption of DoH is not without its challenges and security concerns. One of the primary issues with DoH is its potential to interfere with network visibility and security tools. Many organizations, particularly large enterprises, rely on DNS traffic for monitoring and securing their networks. Traditional DNS allows network administrators to track DNS requests, block access to malicious websites, and enforce policies that prevent users from visiting harmful domains. By encrypting DNS queries, DoH effectively blinds network monitoring tools that rely on DNS data to detect and mitigate security threats, such as malware communicating with command-and-control (C2) servers. This lack of visibility can lead to a breakdown in security policies, as administrators are unable to see where users are navigating online and cannot intercept suspicious or harmful DNS queries.

Another concern is that the widespread adoption of DoH could undermine the security architecture of many corporate and institutional networks. Companies often implement DNS-based security solutions, such as DNS filtering or firewalls, to prevent access to inappropriate or malicious content. With DoH, DNS queries bypass the corporate DNS resolvers, meaning that users’ DNS queries are no longer visible to these internal security systems. Instead, queries are routed through third-party DoH providers, potentially outside the organization’s control. This shift can lead to significant gaps in an organization’s ability to enforce security policies and control DNS traffic, creating blind spots in their overall cybersecurity posture.

Additionally, DoH centralizes DNS queries to a smaller set of DoH resolvers, which may raise concerns about data concentration and trust. In traditional DNS, users can rely on a variety of DNS resolvers, including those provided by their ISP or specific DNS providers chosen for performance or security reasons. However, with DoH, many users will rely on large DoH providers like Google, Cloudflare, or Mozilla for resolving their DNS queries. This centralization can create potential issues with privacy and trust, as it places a great deal of control in the hands of a few major corporations. While DoH providers typically commit to respecting user privacy, this concentration of data could become a target for government surveillance, law enforcement, or even insider threats, given the wealth of data that can be collected from DNS queries.

Another security issue is the possibility of configuration conflicts and mismanagement. Implementing DoH requires careful consideration of how DNS queries are routed and handled by resolvers. In a misconfigured network, there could be conflicting DNS resolution paths, leading to errors, delays, or even security gaps where DNS queries are unintentionally routed through unsecured or less trusted resolvers. Poor implementation of DoH can result in degraded performance, DNS resolution failures, or unintended security vulnerabilities, leaving users exposed to the very threats DoH was designed to prevent.

Moreover, while DoH encrypts DNS queries, it does not solve all DNS security problems. DoH is specifically designed to protect DNS queries from being intercepted or manipulated in transit, but it does not address vulnerabilities that exist in other parts of the DNS ecosystem, such as DNS cache poisoning, or attacks targeting DNS resolvers themselves. Attackers can still target DoH resolvers with denial-of-service (DoS) attacks or attempt to compromise the resolvers to manipulate DNS responses. Furthermore, if an attacker gains access to the end user’s device, they could still manipulate DNS settings or install malware that circumvents the protections offered by DoH.

Lastly, the adoption of DoH could lead to a false sense of security among users and organizations. While DoH improves privacy by encrypting DNS queries, it is not a comprehensive security solution. Users and businesses that adopt DoH may believe that it provides complete protection against DNS-based attacks, potentially neglecting other critical aspects of DNS security, such as monitoring for abnormal traffic patterns, maintaining secure DNS configurations, and adopting DNSSEC to ensure the authenticity of DNS records.

In conclusion, DNS over HTTPS (DoH) brings substantial benefits in terms of privacy and security by encrypting DNS queries and shielding them from surveillance, interception, and manipulation. By embedding DNS traffic within HTTPS, DoH protects users from certain types of attacks and offers an effective method to bypass censorship and maintain privacy in hostile network environments. However, the adoption of DoH also introduces security concerns, particularly regarding the loss of visibility for network monitoring tools, potential centralization of DNS traffic, and configuration challenges. As DoH becomes more widely adopted, both individual users and organizations must weigh the trade-offs between enhanced privacy and potential disruptions to existing security infrastructure. To fully benefit from DoH, it is essential to implement it as part of a broader, multi-layered security strategy that addresses other DNS vulnerabilities and ensures visibility and control over network traffic.

DNS over HTTPS (DoH) represents a significant shift in how domain name resolution is handled across the internet, combining both privacy and security enhancements with the traditional function of the Domain Name System (DNS). As the internet becomes increasingly concerned with privacy protection and secure communication, DoH aims to address one of the more vulnerable…