Analysis of Well-Known DNS over HTTPS Resolvers

DNS over HTTPS (DoH) is one of the protocols adding encryption to DNS and aiming to improve users' privacy. DoH brings more centralization to DNS, leaving the users to pick the default predefined resolver by application or choose custom. Due to the difficulties of DoH resolver discovery, users depend on the publicly available DoH resolver lists. This work studies hundreds of well-known resolvers from comprehensive well-known DoH resolvers list. We provide long-term monitoring results mapping their progression over the last 27 months and examine the active endpoints with extensive testing, including yet-to-cover aspects of long-term IP discovery, HTTP headers, and EDNS padding. Our results bring considerations for the implementation of various supporting mechanisms as well as the settings of the resolvers. We bring insights into the well-known resolvers' potential security, privacy, and performance risks.