Which DNS encryption protocol best protects your web traffic?

The Domain Name System (DNS) is considered by many to be the Internet's directory, converting domain names into computer-readable information, such as IP addresses.

Whenever you write a domain name in the address bar, DNS will automatically convert it to the corresponding IP address. Your browser uses this information to retrieve data from the origin server and load the web page.

But cybercriminals can often monitor DNS traffic, making encryption essential to keep your browsing private and secure.

There are several DNS encryption protocols in use today. These encryption protocols can be used to prevent snooping on the network by encrypting traffic in the HTTPS protocol over a secure transport layer (TLS) connection.

1. DNSCrypt

DNSCrypt is a network protocol that encrypts all DNS traffic between the user's computer and the public nameserver. The protocol uses public key infrastructure (PKI) to verify the authenticity of your DNS server and clients.

It uses two keys, the public key and the private key, to authenticate the communication between the client and the server. When a DNS query is initiated, the client encrypts the query with the server's public key.

The encrypted query is then sent to the server, which decrypts the query with its private key. In this way, DNSCrypt ensures that communication between the client and the server is always authenticated and encrypted.

DNSCrypt is a relatively old network protocol. It has been largely superseded by DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) due to the broader support and stronger security guarantees offered by these newer protocols. .

2. DNS over TLS

Which DNS encryption protocol best protects your web traffic? Picture 1

DNS-over-TLS encrypts your DNS queries using Transport Layer Security (TLS). TLS ensures that your DNS queries are encrypted end-to-end, preventing Man-in-the-Middle (MITM) attacks.

When you use DNS-over-TLS (DoT), your DNS queries are sent to the DNS-over-TLS resolver instead of the unencrypted resolver. The DNS-over-TLS resolver decrypts your DNS query and sends it to the authoritative DNS server on your behalf.

The default port for DoT is TCP port 853. When you connect using DoT, both the client and resolver perform a digital "handshake". The client then sends its DNS query through the encrypted TLS channel to the resolver.

The DNS resolver processes the query, finds the corresponding IP address, and sends the response back to the client via an encrypted channel. The client receives an encrypted response, where it is decrypted and the client uses the IP address to connect to the desired website or service.

3. DNS over HTTPS

HTTPS is the secure version of HTTP currently used to access websites. Like DNS-over-TLS, DNS-over-HTTPS (DoH) also encrypts all information before sending it over the network.

Although the goal is the same, there are some fundamental differences between DoH and DoT. For starters, DoH sends all queries encrypted over HTTPS instead of directly creating a TLS connection to encrypt your traffic.

Second, it uses port 403 for general communication, making it difficult to distinguish from general web traffic. DoT uses port 853, making it much easier to identify traffic from that port and block it.

DoH has seen wider adoption in web browsers like Mozilla Firefox and Google Chrome, as it leverages the existing HTTPS infrastructure. DoT is more commonly used by operating systems and dedicated DNS resolvers, rather than being integrated directly into web browsers.

The two main reasons why DoH is more widely adopted is that it is much easier to integrate into existing web browsers and more importantly, it blends seamlessly with regular web traffic, making blocking becomes much more difficult.

4. DNS over QUIC

Compared to the other DNS encryption protocols on this list, DNS-over-QUIC (DoQ) is relatively new. This is an emerging security protocol that sends DNS queries and responses over the QUIC (Quick UDP Internet Connections) transport protocol.

Most Internet traffic today is based on Transmission Control Protocol (TCP) or User Datagram Protocol (UDP), with DNS queries typically sent over UDP. However, the QUIC protocol was born to overcome some of the disadvantages of TCP/UDP, to reduce latency and improve security.

QUIC is a relatively new transport protocol developed by Google, designed to provide better performance, security, and reliability than traditional protocols such as TCP and TLS. QUIC combines the features of both TCP and UDP, and has built-in encryption similar to TLS.

Since it is newer, DoQ offers several advantages over the protocols mentioned above. For starters, DoQ offers faster performance, reduced overall latency, and improved connection times. This results in faster DNS resolution (the time it takes for DNS to resolve IP addresses). Ultimately, this means websites are served to you faster.

More importantly, DoQ is more resistant to data loss when compared to TCP and UDP, as it can recover from lost packets without requiring a full retransmission, unlike protocols that rely on TCP.

Moreover, it is much easier to migrate connections using QUIC. QUIC encapsulates multiple threads in a single connection, reducing the number of loops required for a connection and thus improving performance. This can also be useful when switching between WiFi and cellular networks.

QUIC is still not widely adopted compared to other protocols. But companies like Apple, Google, and Meta already use QUIC, often creating their own version (Microsoft uses MsQUIC for all of its SMB traffic), which bodes well for the future.

Emerging technologies are expected to fundamentally change the way we access the web. For instance, many companies are now leveraging blockchain technologies to come up with more secure domain naming protocols, like HNS and Unstoppable Domains.

Kareem Winters

Update 27 June 2023