Comparing the Effects of DNS, DoT, and DoH on Web Performance

Hounsel, Austin; Borgolte, Kevin; Schmitt, Paul; Holland, Jordan; Feamster, Nick

doi:10.1145/3366423.3380139

Cited by 48 publications

(47 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Arkko et al propose several strategies for distributing DNS queries and discuss the performance and privacy trade-offs of each strategy [2]. Other previous work also shows that distributing DNS queries across multiple resolvers in various fashions can yield acceptable performance [6,14]. This paper extends this past work, adding additional distribution strategies.…”

Section: Dns Centralizationmentioning

confidence: 70%

“…Other work investigated the adoption of secure DNS and their real-world benefits. Hounsel et al measured web performance when using encrypted DNS protocols and found that in some cases the newer protocols can outperform conventional DNS [14]. Recent proposals from Mozilla and Google involve sending DoH queries directly from the browser to a recursive resolver (sometimes simply referred to as a "resolver") as configured in the browser (perhaps even by default, although as of this writing the default settings have not yet changed).…”

Section: Encrypted Dns Protocolsmentioning

confidence: 99%

See 1 more Smart Citation

Encryption without centralization

Hounsel

Schmitt

Borgolte

et al. 2021

Proceedings of the Applied Networking Research Workshop

Self Cite

View full text Add to dashboard Cite

Emerging protocols such as DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) improve the privacy of DNS queries and responses. While this trend towards encryption is positive, deployment of these protocols has in some cases resulted in further centralization of the DNS, which introduces new challenges. In particular, centralization has consequences for performance, privacy, and availability; a potentially greater concern is that it has become more difficult to control the choice of DNS recursive resolver, particularly for IoT devices. Ultimately, the best strategy for selecting among one or more recursive resolvers may ultimately depend on circumstance, user, and even device. Accordingly, the DNS architecture must permit flexibility in allowing users, devices, and applications to specify these strategies. Towards this goal of increased de-centralization and improved flexibility, this paper presents the design and implementation of a refactored DNS resolver architecture that allows for de-centralized name resolution, preserving the benefits of encrypted DNS while satisfying other desirable properties, including performance and privacy. CCS Concepts• Networks → Network protocol design; Network design principles.

show abstract

Section: Dns Centralizationmentioning

confidence: 70%

Section: Encrypted Dns Protocolsmentioning

confidence: 99%

Encryption without centralization

Hounsel

Schmitt

Borgolte

et al. 2021

Proceedings of the Applied Networking Research Workshop

Self Cite

View full text Add to dashboard Cite

show abstract

“…For each website selected, we extracted the domain names of all included resources found on the page. We obtained this data from HTTP Archive Objects (or "HARs") that we collected from a previous study [9]. Importantly, we needed to ensure that the domain names were not sensitive in nature (e.g., pornhub.com) so as to not trigger DNS-based parental controls.…”

Section: Dns Resolversmentioning

confidence: 99%

“…They find that DNS generally outperforms DoT in response times, and DoT outperforms DoH. Hounsel et al also measure response times and page load times for DNS, DoT, and DoH using Amazon EC2 instances [9]. They find that despite higher response times, page load times for DoT and DoH can be faster than DNS on lossy networks.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Can Encrypted DNS Be Fast?

Hounsel

Schmitt

Borgolte

et al. 2021

Passive and Active Measurement

Self Cite

View full text Add to dashboard Cite

In this paper, we study the performance of encrypted DNS protocols and conventional DNS from thousands of home networks in the United States, over one month in 2020. We perform these measurements from the homes of 2,693 participating panelists in the Federal Communications Commission’s (FCC) Measuring Broadband America program. We found that clients do not have to trade DNS performance for privacy. For certain resolvers, DoT was able to perform faster than DNS in median response times, even as latency increased. We also found significant variation in DoH performance across recursive resolvers. Based on these results, we recommend that DNS clients (e.g., web browsers) should periodically conduct simple latency and response time measurements to determine which protocol and resolver a client should use. No single DNS protocol nor resolver performed the best for all clients.

show abstract

Website blocking in the European Union: Network interference from the perspective of Open Internet

Ververis,

Lasota,

Ermakova

et al. 2023

Policy & Internet

View full text Add to dashboard Cite

By establishing an infrastructure for monitoring and blocking networks in accordance with European Union (EU) law on preventive measures against the spread of information, EU member states have also made it easier to block websites and services and monitor information. While relevant studies have documented Internet censorship in non‐European countries, as well as the use of such infrastructures for political reasons, this study examines network interference practices such as website blocking against the backdrop of an almost complete lack of EU‐related research. Specifically, it performs and demonstrates an analysis for the total of 27 EU countries based on three different sources. They include first, tens of millions of historical network measurements collected in 2020 by Open Observatory of Network Interference volunteers from around the world; second, the publicly available blocking lists used by EU member states; and third, the reports issued by network regulators in each country from May 2020 to April 2021. Our results show that authorities issue multiple types of blocklists. Internet Service Providers limit access to different types and categories of websites and services. Such resources are sometimes blocked for unknown reasons and not included in any of the publicly available blocklists. The study concludes with the hurdles related to network measurements and the nontransparency from regulators regarding specifying website addresses in blocking activities.

show abstract

Comparing the Effects of DNS, DoT, and DoH on Web Performance

Cited by 48 publications

References 16 publications

Encryption without centralization

Encryption without centralization

Can Encrypted DNS Be Fast?

Website blocking in the European Union: Network interference from the perspective of Open Internet

Contact Info

Product

Resources

About