A proposal of DoH-based domain name resolution architecture including authoritative DNS servers

Abstract

In addition to cache poisoning attacks, the privacy leakage has become a critical issue in DNS nowadays. Especially, the communication between the DNS full-service resolver and the authoritative DNS servers may go through multiple ISP networks. Thus, if the communication path contains areas with different privacy policies, the security and privacy in DNS domain name resolution cannot be guaranteed. To mitigate cache poisoning attacks and protect the privacy of the Internet users, we propose a novel architecture that encrypts all DNS communications with DoH. In the proposed architecture, in addition to the communication between the end clients and the DNS full-service resolvers, that between the DNS full-service resolvers and the authoritative DNS servers is also covered by DoH. As a result, not only the risk of cache poisoning attacks can be dramatically mitigated on DNS full-service resolver but also the risk of eavesdropping on DNS traffic can be reduced. Moreover, the proposed architecture is the first approach to pure DoH-based domain name resolution including DNS authoritative DNS servers.