DNS on top of HTTPS

DNS over HTTPS ( DoH ) is an experimental protocol for performing DNS resolution over HTTPS . The purpose of this method is to increase the privacy and security of users by preventing the interception and manipulation of DNS data using attacks like " Intermediary Attack " ^[1] . As of March 2018 , Google and the Mozilla Foundation are testing versions of DNS using the HTTPS protocol ^{[2] [3]} .

In addition to increasing security, another goal of DNS over HTTPS is to improve performance: testing ISP DNS resolvers showed that in many cases they have unexpectedly slow response times, which can be further multiplied by the need to obtain the addresses of many domains, for example, when loading the web -pages ^[1] .

In a publicly implemented version of this protocol, Google uses HTTP GET requests (via HTTPS) to access DNS information using the encoding of the DNS request and the result parameters presented in JSON notation ^[2] .

Another similar specification is in the status of an Internet project under the auspices of the IETF . This protocol version uses the HTTP / 2 and HTTPS protocols , and the original version supports DNS response data in the form of a “wire format” that is returned in existing UDP responses, in the payload with HTTPS - application/dns-udpwireformat , with MIME - application/dns-udpwireformat ^[4] . If HTTP / 2 is used, the server can also use HTTP / 2-server push to send the values ​​that the client will most likely need ^[4] .

In July 2019, Qihoo 360 specialists discovered the world's first malware sample using the DNS protocol over HTTPS: https://blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/