DNSSEC

Posted in

DNS over HTTPS Explained Simply

DNS over HTTPS encrypts DNS queries between your device and a compatible DNS resolver by sending those queries over HTTPS.

It is usually shortened to DoH.

Traditional DNS traffic can be visible to networks between you and your resolver. DNS over HTTPS changes that by carrying DNS requests inside an HTTPS connection protected by TLS. DoH is standardized in RFC 8484.

Why does DNS over HTTPS matter?

Suppose you visit:

example.com

Before connecting, your device usually needs to discover the site’s IP address.

With traditional unencrypted DNS, that lookup may be observable on the local network.

With DNS over HTTPS, the DNS request and response are encrypted while traveling between your device and the DoH resolver.

Does DoH make you anonymous?

No.

That’s one of the biggest misconceptions about DNS over HTTPS.

DoH protects DNS traffic in transit to the resolver, but the resolver itself can still process the domains you’re requesting. Standard DoH therefore should not be confused with an anonymity service.

Is DNS over HTTPS the same as DNSSEC?

No.

They solve different problems.

DoH protects the connection carrying the DNS query. DNSSEC helps verify the authenticity of DNS data.

The two technologies are independent and can work together. RFC 8484 specifically notes that using one does not remove the usefulness of the other.

For home users, DNS over HTTPS can provide greater protection against local DNS monitoring and tampering.

For companies, things become more complicated because organizations may rely on DNS visibility for filtering, security monitoring and internal services. Managed DoH deployments therefore need to fit the organization’s wider DNS strategy.

In simple terms: DNS over HTTPS doesn’t change what DNS does. It changes how your DNS question travels to the resolver.

by William••0
Posted in

How DNSSEC Works?

DNSSEC adds cryptographic verification to DNS so that a resolver can check whether DNS information is authentic and has been altered in transit.

Traditional DNS was designed primarily to answer a question: What address belongs to this name?

It wasn’t originally designed to cryptographically prove that the answer was genuine.

DNSSEC (Domain Name System Security Extensions) helps solve that problem.

How does DNSSEC work?

When DNSSEC is enabled, DNS information can be digitally signed.

A validating DNS resolver checks those signatures and follows a chain of trust through the DNS hierarchy. This allows the resolver to determine whether the response came from the expected DNS zone and whether the signed data has been modified.

You can think of ordinary DNS as receiving a letter.

DNSSEC is like receiving the same letter with a seal that can be independently verified.

Does DNSSEC encrypt DNS?

This is an important distinction.

DNSSEC does not encrypt your DNS queries.

Someone capable of observing your DNS traffic may still be able to see which domain you’re requesting. DNSSEC is primarily concerned with authenticity and integrity, not confidentiality.

Protocols such as DNS over HTTPS (DoH) address a different problem by encrypting communication between a client and DNS resolver. DNSSEC and encrypted DNS can therefore complement each other.

Do you need it?

For domain owners, enabling DNSSEC can provide another layer of protection against forged DNS information.

In many modern DNS platforms, much of the signing process is automated. However, configuration needs to be correct at both the DNS provider and domain registrar so the chain of trust remains intact.

It doesn’t solve every DNS security problem, but it answers one very important question: Can I trust that this DNS answer is authentic?

by William••0