A privacy-preserving full DNS over HTTPS architecture via compatible NS record based information sharing

The encryption of DNS communication for privacy protection has been gaining much attraction in recent years. The IETF has standardized protocols for discovering the encryption method of DNS communication between DNS full-service resolvers and authoritative DNS servers through RFCs 9461 and 9539. However, RFC 9461 has a limitation in that the SVCB records required to discover the encryption protocols supported by authoritative DNS servers must be resolved in plaintext. On the other hand, RFC 9539 generates unnecessary traffic by attempting encrypted communication even with authoritative DNS servers that do not support encryption protocols. Moreover, when both plaintext and encrypted communication are used to maintain compatibility, there is a risk of privacy information leakage. To address this issue, we propose and evaluate a new approach in which the parent authoritative DNS server indicates the encryption protocols supported by the child authoritative DNS server in the NS records during the zone delegation without violating the conventional DNS name resolution. The contributions of this paper can be summarized as i) Design and implement a privacy-preserving full DNS over HTTPS (DoH) architecture. ii) Propose NS record based information sharing to provide a compatibility with existing DNS architecture. iii) The functionality and performance of the proposed method are evaluated using the prototype system. iv) A discussion is provided on the proposed method and further enhancements for DNS privacy protection. Through the evaluations of the prototype system, we confirmed that the proposed architecture outperforms the existing approach using SVCB records to discover the encryption protocols supported by the authoritative DNS servers.