A Longitudinal and Comprehensive Measurement of DNS Strict Privacy
Ruixuan Li, Xiaofeng Jia, Zhenyong Zhang, Jun Shao, Rongxing Lu, Jingqiang Lin, Xiaoqi Jia and Guiyi Wei
ABSTRACT
The DNS privacy protection mechanisms, DNS over TLS (DoT) and DNS over HTTPS (DoH), only work correctly if both the server and client support the Strict Privacy profile and no vulnerability exists in the implemented TLS/HTTPS. A natural question then arises: what is the landscape of DNS Strict Privacy? To this end, we provide the first longitudinal and comprehensive measurement of DoT/DoH deployments in recursive resolvers, authoritative servers, and browsers. With the collected data, we found the number of DoT/DoH servers increased substantially during our ten-month-long scan. However, around 60% of DoT and 44% of DoH recursive resolver certificates were invalid. Worryingly, our measurements confirm the centralization problem of DoT/DoH. Furthermore, we classified DNS Strict Privacy servers into four levels according to the daily scanning results on TLS/HTTPS-related security features. Unfortunately, around 25% of DoH Strict Privacy recursive resolvers fail to meet the minimum level requirements. To help the Internet community better perceive the landscape of DNS Strict Privacy, we implemented a DoT/DoH server search engine and recommender system. Additionally, we investigated five popular browsers across four operating systems and found some inconsistent behavior with their DNS privacy implementations. For example, Firefox in Windows, Linux, and Android allows DoH communication with the server without the SAN certificate. At last, we advocate that all participants head together for a bright DNS Strict Privacy landscape by discussing current hindrances and controversies in DNS privacy.
Dataset
| # | HOST |
|---|---|
| 1 | 45.90.28.102 |
| 2 | 185.228.170.100 |
| 3 | 58.114.35.244 |
| 4 | 176.51.0.104 |
| # | HOST | Path | Response | GetH1 | GetH2 | PostH1 | PostH2 | JsonH1 | JsonH2 |
|---|---|---|---|---|---|---|---|---|---|
| 1 | 1.0.0.1 | dns-query | true | true | true | true | true | false | false |
| 2 | 135.84.253.90 | dns-query | true | false | false | true | true | false | false |
| 3 | 23.247.215.248 | query | true | true | true | true | true | true | true |
| 4 | 188.172.251.1 | resolve | true | true | true | true | true | true | true |
| # | IP | Domain |
|---|---|---|
| 1 | 1.0.0.19 | cloudflare-dns.com |
| 2 | 103.2.186.194 | dns.nextdns.io |
| 3 | 104.220.176.73 | com.apple.dnssd-proxy |
| 4 | 105.233.63.122 | dns.google |
| # | IP | Domain | Path | Response | GetH1 | GetH2 | PostH1 | PostH2 | JsonH1 | JsonH2 |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | 103.247.37.150 | doh.dnsfilter.com | dns-query | true | true | true | true | true | true | true |
| 2 | 130.226.161.34 | anycast.censurfridns.nu | dns-query | true | true | true | true | true | false | false |
| 3 | 167.71.190.157 | doh.syshero.org | dns-query | true | true | true | true | true | false | false |
| 4 | 213.166.247.100 | doh.csaonline.de | query | true | true | true | true | true | false | false |
| # | HOST |
|---|---|
| 1 | b.ns.facebook.com |
| 2 | d.ns.instagram.com |
| 3 | resolver1.opendns.com |
| 4 | ns3.googledomains.com |
| # | HOST | Path | Response | GetH1 | GetH2 | PostH1 | PostH2 | JsonH1 | JsonH2 |
|---|---|---|---|---|---|---|---|---|---|
| 1 | resolver2.opendns.com | dns-query | true | true | true | true | true | false | false |
| 2 | ns.cloudbear.eu | dns-query | true | true | true | true | true | false | false |
| 3 | dns9.quad9.net | dns-query | true | true | true | true | true | false | false |
| 4 | ns2.technitium.com | dns-query | true | true | true | true | true | false | false |
Our detailed measurement datasets are available at Link
Scan Code
We publish our measurement codes at Link
Search Engine and Recommender System