SlideShare a Scribd company logo

LKNOG3 Whats going-on-in-the-world-of-dns

LKNOG
LKNOG

Presentation by Champika Wijayatunga for LKNOG3 Conference in Colombo 2019

1 of 16
Download to read offline
| 1
Champika Wijayatunga
ICANN
2 October 2019
What’s Going On In The World of DNS
LKNOG3 – Colombo – Sri Lanka
| 2
DNS Resolution’s Traditional Model
Stub <-> Recursive <-> Authoritative
¡ Stub resolvers are part of a device’s operating system
¡ Recursive resolvers are typically run by the service provider (e.g., an ISP, or a university, or
a company, etc.)
Because the service provider controls the recursive resolver, many of the needs of the
service provider are met. For example:
¡ Regulatory compliance
• Searches for certain key words that the government requires be logged and/or not
responded to
¡ Malware Protection
• Service providers know to block access to certain sites that seek to harm the end
users
| 3
But the Traditional Model has Some Security Concerns
“The DNS is one of the most significant leaks of data about an individual’s activity on the
Internet.” – Sara Dickinson, Sinodun
¤ DNS queries are sent in cleartext (UDP or TCP) which means anyone
doing passive monitoring of our DNS learns everything we are asking
¤ Queries contain the domain names being asked about, but also contain
metadata about domains for things like the chat services we are using and
the domains of our email contacts
¤ VPNs are not a full solution because some VPNs leak DNS data by
sending the queries over unencrypted channels
¤ DNS responses from the recursive to the stub are the most vulnerable to
being censored or re-written
| 4
Potential Target Points of the DNS Infrastructure/Ecosystem
| 5
One Solution is to Encrypt
¤ Encryption provides privacy assurances:
¡ Queries cannot be surveilled
¡ Eliminates man-in-the-middle attacks
¤ In 2017 and 2018, the IETF standardized two encryption
technologies for DNS:
¡ DNS-over-TLS (DoT)
¡ DNS-over-HTTP (DoH)
| 6
DNS-over-TLS (DoT)
¤ DoT (RFC 7858) takes advantage of Transport Layer Security
(TLS) to encrypt DNS traffic between the stub resolver and the
recursive resolver, giving users authentication and confidentiality
for their DNS queries
¡ Runs on TCP/853 instead on UDP/53
¡ Useable by any application taking advantage of TLS
• Email, Mobile apps that use TLS, Popular sites like Facebook
¤ Does not impact the network operator, ISP, enterprise, or local
government’s requirements to monitor or enforce local policy.

Recommended

LKNOG3 - Telco Cloud Common – VIM/ CIM
LKNOG3 - Telco Cloud Common – VIM/ CIMLKNOG3 - Telco Cloud Common – VIM/ CIM
LKNOG3 - Telco Cloud Common – VIM/ CIMLKNOG
 
LKNOG3 - Tapping into the ISPs
LKNOG3 - Tapping into the ISPsLKNOG3 - Tapping into the ISPs
LKNOG3 - Tapping into the ISPsLKNOG
 
LKNOG3 - Bug Bounty
LKNOG3 - Bug BountyLKNOG3 - Bug Bounty
LKNOG3 - Bug BountyLKNOG
 
LKNOG3-Keynote
LKNOG3-KeynoteLKNOG3-Keynote
LKNOG3-KeynoteLKNOG
 
LKNOG - BCMS
LKNOG - BCMSLKNOG - BCMS
LKNOG - BCMSLKNOG
 
LKNOG3 QoE
LKNOG3 QoELKNOG3 QoE
LKNOG3 QoELKNOG
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfmarketingartwork
 

More Related Content

Recently uploaded

Biometrics Technology Intresting PPT
Biometrics Technology Intresting PPTBiometrics Technology Intresting PPT
Biometrics Technology Intresting PPTPraveenKumarThota7
 
NANOG 90: 'BGP in 2023' presented by Geoff Huston
NANOG 90: 'BGP in 2023' presented by Geoff HustonNANOG 90: 'BGP in 2023' presented by Geoff Huston
NANOG 90: 'BGP in 2023' presented by Geoff HustonAPNIC
 
ConFoo 2024 - Sylius 2.0, top-notch eCommerce for customizable solution
ConFoo 2024 - Sylius 2.0, top-notch eCommerce for customizable solutionConFoo 2024 - Sylius 2.0, top-notch eCommerce for customizable solution
ConFoo 2024 - Sylius 2.0, top-notch eCommerce for customizable solutionŁukasz Chruściel
 
ConFoo 2024 - Need for Speed: Removing speed bumps in API Projects
ConFoo 2024  - Need for Speed: Removing speed bumps in API ProjectsConFoo 2024  - Need for Speed: Removing speed bumps in API Projects
ConFoo 2024 - Need for Speed: Removing speed bumps in API ProjectsŁukasz Chruściel
 
Elevate Your Business: Unleashing Collaboration and Efficiency through Expert...
Elevate Your Business: Unleashing Collaboration and Efficiency through Expert...Elevate Your Business: Unleashing Collaboration and Efficiency through Expert...
Elevate Your Business: Unleashing Collaboration and Efficiency through Expert...Prometix Pty Ltd
 
WAN-IFRA: World Press Trends Outlook 2023-2024
WAN-IFRA: World Press Trends Outlook 2023-2024WAN-IFRA: World Press Trends Outlook 2023-2024
WAN-IFRA: World Press Trends Outlook 2023-2024Damian Radcliffe
 
DNS-OARC 42: Is the DNS ready for IPv6? presentation by Geoff Huston
DNS-OARC 42: Is the DNS ready for IPv6? presentation by Geoff HustonDNS-OARC 42: Is the DNS ready for IPv6? presentation by Geoff Huston
DNS-OARC 42: Is the DNS ready for IPv6? presentation by Geoff HustonAPNIC
 
Information Technology Project to Create a Business
Information Technology Project to Create a BusinessInformation Technology Project to Create a Business
Information Technology Project to Create a Businessmbowl010
 
Reactive programming with Spring Webflux.pptx
Reactive programming with Spring Webflux.pptxReactive programming with Spring Webflux.pptx
Reactive programming with Spring Webflux.pptxJoão Esperancinha
 
Seagate HDD Firmware Repair Tool Datasheet 2024
Seagate HDD Firmware Repair Tool Datasheet 2024Seagate HDD Firmware Repair Tool Datasheet 2024
Seagate HDD Firmware Repair Tool Datasheet 2024Dolphin Data Lab
 

Recently uploaded (10)

Biometrics Technology Intresting PPT
Biometrics Technology Intresting PPTBiometrics Technology Intresting PPT
Biometrics Technology Intresting PPT
 
NANOG 90: 'BGP in 2023' presented by Geoff Huston
NANOG 90: 'BGP in 2023' presented by Geoff HustonNANOG 90: 'BGP in 2023' presented by Geoff Huston
NANOG 90: 'BGP in 2023' presented by Geoff Huston
 
ConFoo 2024 - Sylius 2.0, top-notch eCommerce for customizable solution
ConFoo 2024 - Sylius 2.0, top-notch eCommerce for customizable solutionConFoo 2024 - Sylius 2.0, top-notch eCommerce for customizable solution
ConFoo 2024 - Sylius 2.0, top-notch eCommerce for customizable solution
 
ConFoo 2024 - Need for Speed: Removing speed bumps in API Projects
ConFoo 2024  - Need for Speed: Removing speed bumps in API ProjectsConFoo 2024  - Need for Speed: Removing speed bumps in API Projects
ConFoo 2024 - Need for Speed: Removing speed bumps in API Projects
 
Elevate Your Business: Unleashing Collaboration and Efficiency through Expert...
Elevate Your Business: Unleashing Collaboration and Efficiency through Expert...Elevate Your Business: Unleashing Collaboration and Efficiency through Expert...
Elevate Your Business: Unleashing Collaboration and Efficiency through Expert...
 
WAN-IFRA: World Press Trends Outlook 2023-2024
WAN-IFRA: World Press Trends Outlook 2023-2024WAN-IFRA: World Press Trends Outlook 2023-2024
WAN-IFRA: World Press Trends Outlook 2023-2024
 
DNS-OARC 42: Is the DNS ready for IPv6? presentation by Geoff Huston
DNS-OARC 42: Is the DNS ready for IPv6? presentation by Geoff HustonDNS-OARC 42: Is the DNS ready for IPv6? presentation by Geoff Huston
DNS-OARC 42: Is the DNS ready for IPv6? presentation by Geoff Huston
 
Information Technology Project to Create a Business
Information Technology Project to Create a BusinessInformation Technology Project to Create a Business
Information Technology Project to Create a Business
 
Reactive programming with Spring Webflux.pptx
Reactive programming with Spring Webflux.pptxReactive programming with Spring Webflux.pptx
Reactive programming with Spring Webflux.pptx
 
Seagate HDD Firmware Repair Tool Datasheet 2024
Seagate HDD Firmware Repair Tool Datasheet 2024Seagate HDD Firmware Repair Tool Datasheet 2024
Seagate HDD Firmware Repair Tool Datasheet 2024
 

Featured

PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024Neil Kimberley
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)contently
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024Albert Qian
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsKurio // The Social Media Age(ncy)
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Search Engine Journal
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summarySpeakerHub
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next Tessa Mero
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentLily Ray
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best PracticesVit Horky
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project managementMindGenius
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...RachelPearson36
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Applitools
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at WorkGetSmarter
 
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...DevGAMM Conference
 
Barbie - Brand Strategy Presentation
Barbie - Brand Strategy PresentationBarbie - Brand Strategy Presentation
Barbie - Brand Strategy PresentationErica Santiago
 

Featured (20)

PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work
 
ChatGPT webinar slides
ChatGPT webinar slidesChatGPT webinar slides
ChatGPT webinar slides
 
More than Just Lines on a Map: Best Practices for U.S Bike Routes
More than Just Lines on a Map: Best Practices for U.S Bike RoutesMore than Just Lines on a Map: Best Practices for U.S Bike Routes
More than Just Lines on a Map: Best Practices for U.S Bike Routes
 
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
 
Barbie - Brand Strategy Presentation
Barbie - Brand Strategy PresentationBarbie - Brand Strategy Presentation
Barbie - Brand Strategy Presentation
 

LKNOG3 Whats going-on-in-the-world-of-dns

  • 1. | 1 Champika Wijayatunga ICANN 2 October 2019 What’s Going On In The World of DNS LKNOG3 – Colombo – Sri Lanka
  • 2. | 2 DNS Resolution’s Traditional Model Stub <-> Recursive <-> Authoritative ¡ Stub resolvers are part of a device’s operating system ¡ Recursive resolvers are typically run by the service provider (e.g., an ISP, or a university, or a company, etc.) Because the service provider controls the recursive resolver, many of the needs of the service provider are met. For example: ¡ Regulatory compliance • Searches for certain key words that the government requires be logged and/or not responded to ¡ Malware Protection • Service providers know to block access to certain sites that seek to harm the end users
  • 3. | 3 But the Traditional Model has Some Security Concerns “The DNS is one of the most significant leaks of data about an individual’s activity on the Internet.” – Sara Dickinson, Sinodun ¤ DNS queries are sent in cleartext (UDP or TCP) which means anyone doing passive monitoring of our DNS learns everything we are asking ¤ Queries contain the domain names being asked about, but also contain metadata about domains for things like the chat services we are using and the domains of our email contacts ¤ VPNs are not a full solution because some VPNs leak DNS data by sending the queries over unencrypted channels ¤ DNS responses from the recursive to the stub are the most vulnerable to being censored or re-written
  • 4. | 4 Potential Target Points of the DNS Infrastructure/Ecosystem
  • 5. | 5 One Solution is to Encrypt ¤ Encryption provides privacy assurances: ¡ Queries cannot be surveilled ¡ Eliminates man-in-the-middle attacks ¤ In 2017 and 2018, the IETF standardized two encryption technologies for DNS: ¡ DNS-over-TLS (DoT) ¡ DNS-over-HTTP (DoH)
  • 6. | 6 DNS-over-TLS (DoT) ¤ DoT (RFC 7858) takes advantage of Transport Layer Security (TLS) to encrypt DNS traffic between the stub resolver and the recursive resolver, giving users authentication and confidentiality for their DNS queries ¡ Runs on TCP/853 instead on UDP/53 ¡ Useable by any application taking advantage of TLS • Email, Mobile apps that use TLS, Popular sites like Facebook ¤ Does not impact the network operator, ISP, enterprise, or local government’s requirements to monitor or enforce local policy.
  • 7. | 7 DNS-over-HTTPS (DoH - RFC 8484) ¤ Who do you trust? ¡ “I trust my bank to give them my money.” ¡ “I trust my bank enough to do online banking with them.” ¡ “Maybe my bank is the most trusted vendor I should use for recursive resolver service.” ¤ The Trusted Recursive Resolver (TRR) model ¡ The user decides who she trusts the most with her DNS traffic, and configures the DoH application to use a trusted DoH resolver ¤ Runs on TCP/443 and is co-mingled with web traffic in a single HTTPS packet, making it much harder to discover and filter
  • 8. | 8 Public Resolvers ¤ A recent measurements into resolver centrality has shown that it takes about 8 to 9 resolvers to cover the request of 50% of the internet users. ¡ Google Public DNS alone (4.4.4.4 and 8.8.8.8) answered about 33% of the queries ¡ Other big global resolvers included China Unicom, China Mobile, DNSpai, Comcast, and OpenDNS (Cisco Umbrella) ¡ There are quite a few large public DNS operators these days, including: • Cloudflare (1.1.1.1) • Quad9 (9.9.9.9) • TWNIC (101.101.101.101)
  • 10. | 10 But This New Model Prompts Some Concerns ¤ Service providers have a new paradigm to negotiate: ¡ No longer able to use DNS to meet needs like regulatory compliance and malware protection ¡ What happens if it does not work? The user configures her web browser to use a DoH resolver. For whatever reason, DNS resolution stops working properly. A major concern for service providers is that the user now calls them and asks for help. ¡ ISPs do significant business working with parents on parental controls. When applications do their own DNS, a lot of these parental controls no longer work. ¡ ISPs often receive court orders to block certain sites. DoH resolvers do not know about these court orders, and still resolve these sites.
  • 11. | 11 Public Policy Concerns ¤ Stepping back from the service provider concerns, DoH introduces all new challenges for broader public policy: ¡ Which laws apply? • In the traditional model, the recursive resolver providing the answers to the end user device is generally found in the same country as the user. Applications doing their own DNS with DoH will sometimes mean that the recursive resolver is in a different country, which means a different legal jurisdiction. • Very important when you think about complex topics like content filtering laws and end user data privacy regulations
  • 12. | 12 Taking a Further Step Back ¤ Stepping back from the service provider concerns, DoH introduces all new challenges for broader public policy: ¡ Who gets to determine the DoH resolver? • The DoH protocol was designed to allow the end user to decide who they trust most for recursive DNS service. But nothing stops the application maker from deciding for the user what DoH resolver will be used. • What if the application maker is not honest and is purposely using a DoH resolver which steers queries away from their intended sites and instead, provides DNS answers to sites that the application maker can profit from? • What if the DoH resolver operator is monetizing DNS data without the user’s consent? • Bad or dishonest implementations of DoH disempower end users, and do so in a context that most end users know nothing about: recursive DNS resolution
  • 13. | 13 Parting Thoughts on Applications Doing DNS (ADD) ¤ Applications doing their own DNS with DoH is new, but it is already being implemented in web browsers and mobile applications. As an operator or as a policy maker, it’s a good time to pay attention to how vendors are implementing ADD. ¤ DNS abuse continues to be an issue. Since DNS is a gateway into your systems, it is important to prioritize it in your policy making and security efforts ¤ DNS privacy – especially end user DNS data privacy – is a major regulatory and societal concern. You need to consider how better end user privacy in the DNS reconciles with certain top-down regulations (e.g. filtering) ¤ Encrypting data with TLS or HTTPS is good for addressing privacy concerns ¤ But implementation details matter, and there are a lot of public policy concerns for how DoH could be implemented in a way that has negative effects for end users, for service providers, and for regulators.
  • 14. | 14 Moving Forward ¤ Where do we discuss these broad issues? ¡ ICANN? ¡ Network Operator forums? ¡ IETF? ¡ Regional/Local public policy forums? ¡ Etc. ¤ The answer is probably: all of the above. Which imply that consultation and collaboration will be needed to identify issues and find resolutions.
  • 15. | 15 Get Involved and Informed Attend an ICANN Public Meeting. Three times a year, ICANN holds free and open public meetings in different regions around the world. Visit meetings.icann.org to learn more. Visit go.icann.org/journey to learn how you can attend an ICANN Public Meeting as part of the NextGen@ICANN or ICANN Fellowship programs. Take a free online course at learn.icann.org. Attend events in your region. Find and participate in an ICANN community group by visiting icann.org/community. Sign up for ICANN news alerts and regional newsletters.
  • 16. Visit us at icann.org | 16 Engage with ICANN – Thank You and Questions Email: champika.wijayatunga@icann.org