K-resolver: Towards Decentralizing Encrypted DNS Resolution

Abstract

Centralized DNS over HTTPS/TLS (DoH/DoT) resolution, which has started being deployed by major hosting providers and web browsers, has sparked controversy among Internet activists and privacy advocates due to several privacy concerns. This design decision causes the trace of all DNS resolutions to be exposed to a third-party resolver, different than the one specified by the user's access network. In this work we propose K-resolver, a DNS resolution mechanism that disperses DNS queries across multiple DoH resolvers, reducing the amount of information about a user's browsing activity exposed to each individual resolver. As a result, none of the resolvers can learn a user's entire web browsing history. We have implemented a prototype of our approach for Mozilla Firefox, and used it to evaluate the performance of web page load time compared to the default centralized DoH approach. While our K-resolver mechanism has some effect on DNS resolution time and web page load time, we show that this is mainly due to the geographical location of the selected DoH servers. When more well-provisioned anycast servers are available, our approach incurs negligible overhead while improving user privacy.

Encryption without centralization

“…Moura et al [21] also encounter centralization in their study of DNS requests to two country code top-level domains (ccTLD), with five large cloud providers being responsible for over 30% of all queries for the ccTLDs of the Netherlands and New Zealand. Recent developments suggest that these trends could be reversed; for example, Hoang et al [12] propose and evaluate K-resolver, which distributes queries over multiple DoH recursors in Firefox, so that no single resolver can build a complete profile of the user and each recursor only learns a subset of domains the user resolved. Arkko et al propose several strategies for distributing DNS queries and discuss the performance and privacy trade-offs of each strategy [2].…”

Toward Domain Name System privacy enhancement using intent‐based Moving Target Defense framework over software defined networks

“…Although privacy issues of DNS have been addressed in literature, 6,22,23 the use of MTD for user privacy protection is limited. 24 The main motivation of our work is the exploitation of the MTD for privacy enhancement.…”