- Impact
- 23,125
Can the DNS support encryption without enabling centralization?
Read more (blog)
https://blog.apnic.net/2021/10/13/can-dns-support-encryption-without-enabling-centralization/
Whitepaper (pdf)
https://arxiv.org/pdf/2002.09055.pdf
DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) improve the privacy of DNS queries and responses. While encryption is a positive thing, deployment of these protocols has, in some cases, resulted in further centralization of the DNS, introducing new challenges. In particular, centralization has consequences for performance, privacy, and availability. A potentially greater concern is that it has become more difficult for clients to control their choice of recursive resolver, particularly for IoT devices.
Can the DNS architecture support encryption without enabling centralization?
Can the DNS architecture support encryption without enabling centralization?
Read more (blog)
https://blog.apnic.net/2021/10/13/can-dns-support-encryption-without-enabling-centralization/
Whitepaper (pdf)
Abstract: Emerging protocols such as DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) improve the privacy of DNS queries and responses. While this trend towards encryption is positive, deployment of these protocols has in some cases resulted in further centralization of the DNS, which introduces new challenges. In particular, centralization has consequences for performance, privacy, and availability; a potentially greater concern is that it has become more difficult to control the choice of DNS recursive resolver, particularly for IoT devices. Ultimately, the best strategy for selecting among one or more recursive resolvers may ultimately depend on circumstance, user, and even device. Accordingly, the DNS architecture must permit flexibility in allowing users, devices, and applications to specify these strategies. Towards this goal of increased decentralization and improved flexibility, this paper presents the design and implementation of a refactored DNS resolver architecture that allows for decentralized name resolution, preserving the benefits of encrypted DNS while satisfying other desirable properties, including performance and privacy.
https://arxiv.org/pdf/2002.09055.pdf
Last edited:
