Large Scale Analysis of DoH Deployment on the Internet

Abstract

DNS over HTTPS (DoH) is one of the standards to protect the security and privacy of users. The choice of DoH provider has controversial consequences, from monopolisation of surveillance to lost visibility by network administrators and security providers. More importantly, it is a novel security business. Software products and organisations depend on users choosing well-known and trusted DoH resolvers. However, there is no comprehensive study on the number of DoH resolvers on the Internet, its growth, and the trustworthiness of the organisations behind them. This paper studies the deployment of DoH resolvers by (i) scanning the whole Internet for DoH resolvers in 2021 and 2022; (ii) creating lists of well-known DoH resolvers by the community; (iii) characterising what those resolvers are, (iv) comparing the growth and differences. Results show that (i) the number of DoH resolvers increased 4.8 times in the period 2021–2022, (ii) the number of organisations providing DoH services has doubled, and (iii) the number of DoH resolvers in 2022 is 28 times larger than the number of well-known DoH resolvers by the community. Moreover, 94% of the public DoH resolvers on the Internet are unknown to the community, 77% use certificates from free services, and 57% belong to unknown organisations or personal servers. We conclude that the number of DoH resolvers is growing at a fast rate; also that at least 30% of them are not completely trustworthy and users should be very careful when choosing a DoH resolver.

A 8 Appendix

1.1 A.1 8.1 Ethical Considerations

Part of our research involved technical actions that require an ethical explanation and support.

Horizontal Port Scanning. of the Internet has many implications. Although in general considered an ethical practice [23], we analyse the implications of our actions. First, our horizontal port scan sent 3 packets per port to each IP address with a rate limit. This amount of packets is not enough to consume the bandwidth of any device, nor to force errors in the services, especially since our scan did not close the TCP handshake. Therefore, the technical risk of errors or problems in devices due to our scan is negligible. Higher rates of scanning or frequency of the scans, i.e. weekly scans can pose some threat to some services availability, and thus we limited the methodology accordingly. Some honeypot devices on the Internet detected our scan and report the source IP as an attacker; however, since the IP address was not really attacking, there was an impact of having the IP in block lists for some days.

The action of verifying the DoH protocol required us to connect to all ports 443/TCP and try to find out if they spoke DoH or not. It required the request for the TLS protocol handshake and then the DoH protocol. We measure the technical impact by testing our Nmap script against our own servers, and no server was impacted by our script, was taken down, or slowed in any way. We consider the script safe and with very low impact. The script made 6 connections in total to each server.

The action of analysing DoH resolvers implied a more thorough analysis of the responses and information found about this server on the Internet. We only performed this action with the few (order of thousands) found DoH resolvers and we continually verified that they were not affected by our DNS requests.

We consider our techniques to have very low impact on the servers scanned and without reason to suspect that our actions affected the servers contacted in any way.

Publishing the List of DoH Resolvers. can significantly impact the citizens of oppressive countries that use DoH to avoid surveillance or access censored websites from the free world. The oppressive government can misuse two outcomes of our research: 1) the list of DoH resolvers can be used for DoH blocking to enforce DNS surveillance and censorship, and 2) the methodology for creation and updates of such a list.

Nevertheless, as shown in our research, the IP addresses of DoH resolvers constantly change, making the efficiency of IP-based filtering limited as discussed in the Sect. 7. Regardless of the described methodology, we argue that the methodology presented in this work is not novel nor technically complex, and uses of the freely available tools. An oppressive regime interested in DoH blocking already could have its own DoH scanning and detection infrastructure.

Besides, DoH does not entirely bypass mass censorship or surveillance. For example, domain names transferred in TLS SNI are still visible and used by large censorship systems [6]. Therefore citizens living under an oppressive regime still need to use other privacy-preserving technologies such as Virtual Private Networks to avoid censorship.

Given that, we do not consider our research would contribute to oppression by authoritarian countries or decrease the Internet privacy. Instead, our study provides essential findings about DoH resolvers worldwide and points out security concerns arising from anonymous DoH resolvers.

1.2 B.2 8.2 Nmap Configuration

The Scan2021 used Nmap insane timing template and 1 maximum number of retries, to minimise scanning time.

The Scan2022 used Nmap normal timing template to minimise the number of packets lost.

See Nmap timing templates for detailed timeout information of each mode.

https://nmap.org/book/performance-timing-templates.html.