Encrypted DNS traffic explained

What is encrypted DNS traffic?

Encrypting DNS traffic means protecting DNS requests with encryption while they are in transit. When you type a domain name into your browser, a DNS lookup request is sent to a server, known as a DNS resolver. This server matches domain names with IP addresses, and its job is to find the IP address of the site you’re trying to visit.

Once the resolver has this information, it sends the IP address back through your router to your device, allowing you to access the website.

DNS queries are essential for a smooth internet experience, but they are vulnerable to a variety of DNS attacks, including DNS spoofing and man-in-the-middle attacks. To guard against these risks, DNS queries can be encrypted using various methods.

How does encrypted DNS traffic work?

DNS requests can be encrypted using encryption protocols. If DNS traffic is not encrypted, there is a possibility that an unsecured connection could expose this data to outside eyes.

By configuring encryption protocols on your network, however, you can scramble your data and make it incomprehensible to anyone but the intended recipient (the resolver). If your internet service provider (ISP) or a malicious actor is able to view or intercept DNS queries, all they will receive is strings of encrypted, unreadable characters.

For DNS traffic to work, the resolver must be compatible with the encryption protocols used on your network. These protocols are essential for secure DNS transfer.

Different methods of DNS encryption

The three main types of DNS protection are DNS over HTTPS (DoH), DNS over TLS (DoT), and DNSCrypt, and we’ll be covering all of them in detail.

DNS over HTTPS (DoH)

DNS over HTTPS (DoH) involves DNS data being sent through an HTTPS connection. HTTPS is the standard protocol used on most websites. If your encrypted DNS traffic is secured with HTTPS, anyone who intercepts it will only have the encrypted version, not the plaintext DNS request itself.

DNS over TLS (DoT)

DNS over TLS (DoT) is another encryption method for DNS traffic. In this case, data is encrypted and moved via the Transport Layer Security protocol. As with DoH, the DNS traffic benefits from end-to-end encryption while in transit. However, while DoH sends encrypted DNS traffic to and from the same port as all HTTPS traffic (bearing in mind that most websites use HTTPS), DoT data moves through a separate port. As a result, it is easier to troubleshoot DoT and isolate potential problems with the protocol.

DNSCrypt

DNSCrypt is a protocol that will allow you to benefit from encrypted DNS traffic. It uses end-to-end encryption, like DoH and DoT, but its distinguishing feature is its capacity to prevent DNS spoofing attacks. The protocol authenticates traffic to make sure that it hasn’t been tampered with and that it has come from the correct DNS resolver.

Pros and cons of DNS encryption

Encrypting DNS data is a useful security measure, but it does have some downsides. Let’s explore the pros and cons of encrypting DNS requests and responses.

Pros

1. Improved privacy: If DNS traffic is encrypted, it cannot be viewed by outside parties while in transit. Using any of the protocols discussed earlier in this article — DoH, DoT, or DNSCrypt — will boost your privacy, though much of your browsing traffic will still be visible, unless you use an encryption service like a VPN.
2. Security: DNS protection lowers the risks posed by man-in-the-middle attacks and prevents DNS data from being tampered with by malicious actors during transit. As a result of the encryption, users are less likely to become the victims of DNS hijacking and spoofing.

Cons

1. Performance and speed reduction: Encrypting and decrypting DNS traffic adds additional steps to the DNS resolution process, causing users to experience marginally slower connection speeds and poorer performance while DNS queries are being resolved by the DNS server.
2. Compatibility issues: Some hardware, DNS resolvers, and Wi-Fi networks may not support DNS encryption protocols, leading to compatibility issues. In some cases, these problems might be intentional. An internet service provider (ISP) can actually prevent you from using encryption protocols, resulting in a “This network is blocking encrypted DNS traffic” warning message.
3. Protocols and providers: Some protocols won’t be supported by certain DNS service providers. This means that, depending on the DNS server settings, you may have to switch between DNS providers to keep your network processes running smoothly. This just adds to the overall complexity of setting up and maintaining a DNS protection system.

Overall, encrypted DNS traffic is a useful tool, but not one that will solve all of your security and privacy issues. A simpler way to make your network safer is by using a VPN.

With services like NordVPN, you can provide individual devices on your network with an encrypted connection, as well as routers and internet gateways. NordVPN encrypts all browsing traffic in transit between a device and a VPN server, making it harder for internet service providers or a malicious actor to spy on your data.