Oblivious DNS: Practical Privacy for DNS Queries

Abstract

Virtually every Internet communication typically involves a Domain Name System (DNS) lookup for the destination server that the client wants to communicate with. Operators of DNS recursive resolvers-the machines that receive a client's query for a domain name and resolve it to a corresponding IP address-can learn significant information about client activity. Past work, for example, indicates that DNS queries reveal information ranging from web browsing activity to the types of devices that a user has in their home. Recognizing the privacy vulnerabilities associated with DNS queries, various third parties have created alternate DNS services that obscure a user's DNS queries from his or her Internet service provider. Yet, these systems merely transfer trust to a different third party. We argue that no single party ought to be able to associate DNS queries with a client IP address that issues those queries. To this end, we present Oblivious DNS (ODNS), which introduces an additional layer of obfuscation between clients and their queries. To do so, ODNS uses its own authoritative namespace; the authoritative servers for the ODNS namespace act as recursive resolvers for the DNS queries that they receive, but they never see the IP addresses for the clients that initiated these queries. We present an initial deployment of ODNS; our experiments show that ODNS introduces minimal performance overhead, both for individual queries and for web page loads. We design ODNS to be compatible with existing DNS protocols and infrastructure, and we are actively working on an open standard with the IETF.

Keeping the Smart Home Private with Smart(er) IoT Traffic Shaping

“…If DNS requests or destination IP addresses are obfuscated, such as for an external adversary outside a VPN, for a local adversary without Wi-Fi network access, or through DNS over TLS (DoT) [23], DNS over HTTPS (DoH) [22], or Oblivious DNS (ODNS) [35], then device fingerprinting would have to be performed using traffic rate characteristics [2,36]. Our STP algorithm (Section 6) protects against user activity inference from traffic rates independent of the device identification technique employed by the adversary.…”

“…While requiring a VPN raises threshold for adoption, personal VPN usage is becoming more common due to increased privacy awareness [19] and availability of non-enterprise VPN services, such as home routers with built-in VPN [34] and Google's Project Fi VPN [26]. Alternatively, specific categorical metadata could also be protected by existing protocols, such as obfuscating DNS via DNS over TLS (DoT) [23], DNS over HTTPS (DoH) [22], or Oblivious DNS (ODNS) [35]. DoT, DoH, and ODNS traffic may still need to be shaped separately from non-DNS traffic to prevent web domain inference from packet lengths and other rate characteristics [23].…”

K-resolver: Towards Decentralizing Encrypted DNS Resolution

“…Schmitt et al [41] propose a resolution mechanism to anonymize users' DNS queries by decoupling the link between users and their DNS queries. More specifically, the mechanism introduces an entity, called an Oblivious DNS (ODNS) resolver, residing between the user and the traditional recursor.…”

Analyzing the costs (and benefits) of DNS, DoT, and DoH for the modern web

“…However, for DNSCrypt and DNSCurve, the recursive resolver remains aware of what names a client queries for, which has privacy implications as it allows the recursor to learn about the websites that the client visits and when it visits them. Schmitt et al [33] proposed oblivious DNS, which prevents a resolver from associating queries to the clients that sent them, and, thus, prevents a recursor from learning a client's browsing behavior.…”