Mitigating against and observing DoH – a real world deployment

DoH data flow

Whilst there has been a lot of discussion about the impact and usage of DNS-over-HTTPs there is so far very little data on how widely its usage has been adopted let alone what the traffic looks like. By adopting a layered approach using response policy zones and an internal DNS-over-HTTPS infrastructure it’s possible to start to get a clearer picture of DoH usage. Within a typical Enterprise environment, you would expect the use of external DNS servers to already be prohibited. The use of DNS-over-HTTPS is thus no different from any other tunnelling software that is used to circumvent such security controls. The simple approach to resolving this issue would be to just block DoH providers at the firewall as they were identified. However, maintaining such a list, as with any black list, will present some challenges and would be better managed by commercial providers. A more layered approach provides… Continue reading

DoH no!

As was entirely predictable DNS-over-HTTPS has now been implicated in a spam campaign. Google DoH instance was used to access TXT records to control the spam campaign via a bit of javascript on web pages. This isn’t a weakness in DNS or for that matter in DoH, it’s just using Googles DoH as a side channel. They could have achieved the same thing by accessing a specific web page, but that would be more easily blocked or shut down. There are also mobile application, both IOS and android, that are using DoH by default without giving the user a choice in the matter*. At this point if you use DNS as part of your security posture – either via RPZ, pi-hole or some other mechanism ( and if you aren’t you really should ) then you need to be blocking DoH. At present there are over 70 advertised public DoH… Continue reading

RPZs a personal history

Ten years ago today at a “secure off site meeting” ( i.e. in the pub ) I asked a colleague if there was any reason why we couldn’t use DNS load balancers to “load balance” bad domains to an address of our choosing. After some thought there didn’t seem to be any reason why we couldn’t do it or why it wouldn’t work. So the next morning as it still seemed like a good idea we added load balancing rules for three choice domains with less than savoury reputation. This quickly proved to be quite a successful tactic so we dubbed it “the naughty step”, and assumed that as it was such an “obvious” thing to do loads of other people must also be doing it. After we’d been going on like this for a while Paul Vixie published his excellent article on taking back DNS, which gave us a… Continue reading