Secure DNS Monitoring With DNS Over HTTPS (DoH)

Secure DNS monitoring with DoH

DNS is fundamental to the availability of websites and online services. However, traditional DNS queries are typically transmitted without encryption, which can expose DNS traffic to interception or modification while in transit.

DNS Server monitoring supports DNS over HTTPS (DoH), allowing you to monitor DNS resolution over an encrypted HTTPS connection. This helps you validate the availability and performance of DNS services that support DoH while ensuring that DNS queries exchanged during monitoring are protected in transit.

What is DoH?

DoH is a protocol that sends DNS queries and responses over HTTPS instead of using traditional DNS communication over UDP or TCP.

With traditional DNS, queries and responses are generally transmitted in plaintext. DoH encapsulates DNS messages within HTTPS and protects the communication using TLS encryption.

Because the DNS request is transmitted over HTTPS, DoH helps protect DNS traffic from being read or modified by intermediaries while it travels between the client and the DoH-enabled DNS server.

DoH vs. traditional DNS

Traditional DNS and DoH perform the same fundamental function: resolving domain names and retrieving DNS records. The primary difference is how the DNS query is transported.

Traditional DNS
DoH
DNS queries are typically transmitted over UDP or TCP.
DNS queries are transmitted over HTTPS.
DNS traffic is generally unencrypted.
DNS traffic is encrypted using HTTPS/TLS.
DNS queries may be visible to intermediaries on the network path.
The contents of DNS queries are protected from passive observation while in transit.
Commonly uses port 53.
Typically uses HTTPS port 443.

DoH protects the transport of DNS queries and responses. It does not replace Domain Name System Security Extensions (DNSSEC). While DoH encrypts communication between the client and DNS resolver, DNSSEC is designed to validate the authenticity and integrity of DNS data.

Benefits of using DoH in DNS monitoring

Using DoH with DNS Server monitoring provides you with the following benefits:
  1. Encrypt DNS communication: Secure DNS queries and responses in transit using encrypted HTTPS connections.
  2. Reduce interception risks: Protect DNS traffic from eavesdropping and tampering during transmission.
  3. Monitor DoH-enabled DNS infrastructure: Validate DNS services using the encrypted DoH protocol.
  4. Validate availability and resolution: Verify that the DoH endpoint is reachable and resolves domains as expected.

Monitor from multiple locations

By monitoring from your configured locations, you can identify whether a DoH service is reachable and resolving correctly from the locations relevant to your users and applications.

How does DoH monitoring work?

When DoH is configured for a DNS Server monitor, DNS queries are sent to the configured DNS server over HTTPS instead of using traditional DNS over UDP or TCP. To configure DoH for your DNS Server monitor, follow these steps to add a DNS Server monitor.

The monitoring flow is:
Monitoring location → HTTPS/TLS connection → DoH endpoint → DNS resolution → DNS response

During every poll:
  1. The monitoring location initiates a connection to the configured DoH endpoint.
  2. The monitoring location establishes a secure HTTPS connection.
  3. The monitoring location sends the DNS query for the configured domain and record type over HTTPS.
  4. The DoH server processes the DNS query.
  5. The DoH server returns the DNS response through the encrypted HTTPS connection.
  6. The monitor validates the response based on the DNS monitor configuration.
  7. The monitor records the availability and performance of the DNS resolution.
If the DNS query fails or the response does not meet the configured validation criteria, the monitor status changes based on the configured thresholds and notification settings.

Conclusion

DNS over HTTPS adds an encrypted transport layer to DNS communication, helping protect DNS queries and responses while they travel across the network.

With DoH support in DNS Server monitoring, you can monitor the availability, performance, and resolution behavior of DoH-enabled DNS services while using an encrypted HTTPS connection for DNS queries.

This enables you to validate not only whether your DNS service is resolving domains correctly, but also whether the encrypted DNS path used by your applications and users remains available and responsive.