DoH DoT and DNSSEC

DNS queries traditionally traverse networks using UDP or TCP on port 53, where data is sent unencrypted. To bolster both security and privacy, two modern protocols—DoH and DoT—have emerged.

Secure DNS: DoH and DoT

• DoH (DNS over HTTPS): Encapsulates DNS queries within HTTPS, encrypting the data in transit.
• DoT (DNS over TLS): Utilizes TLS encryption to secure DNS queries.

With both protocols, a DNS query is sent to a resolver that supports encryption. The resolver decrypts the request, performs the DNS lookup using standard, unencrypted DNS servers, and then re-encrypts the response for secure transmission back to the client.

For example, Cloudflare provides a DoH endpoint that can be used with command-line tools. The DNSzones.dev web application leverages Cloudflare's DoH endpoint. To send a DNS query over DoH via the command line, you can use cURL as follows:

$ curl -H "accept: application/dns-json" "https://cloudflare-dns.com/dns-query?name=wikipedia.org&type=A"
{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"wikipedia.org","type":1}],"Answer":[{"name":"wikipedia.org","type":1,"TTL":252,"data":"208.80.153.224"}]}

This approach works similarly to DIG, but instead of using traditional UDP or TCP, it leverages HTTPS for secure DNS queries.

Understanding DNSSEC

In addition to these secure transport protocols, DNSSEC (Domain Name System Security Extensions) enhances DNS security by digitally signing DNS records. Unlike DoH and DoT, which focus solely on encrypting data during transit, DNSSEC ensures the authenticity and integrity of the DNS data itself.

Key Differences: DNS Encryption vs. DNS Data Validation

When using DoH, HTTPS encryption (SSL/TLS) secures the data in transit, including the required HTTP headers. In contrast, DNSSEC embeds cryptographic signatures (e.g., RRSIG records) within DNS responses, enabling client resolvers to validate that the data originates from a trusted authoritative server.

How DNSSEC Works

The validation process with DNSSEC begins when a client sends a DNS query. Often, the query includes an OPT record with the DNSSEC OK (DO) flag set, indicating the client's request for DNSSEC data. When a domain is DNSSEC-enabled, the resolver uses the appropriate public keys to verify digital signatures included in the response.

Trusted key-signing ceremonies at the root and top-level domains (TLD) create a chain of trust throughout the DNS infrastructure. These ceremonies involve experts who rigorously generate and securely store cryptographic keys, ensuring that DNS responses are only accepted if properly signed by legitimate servers.

Using DIG with DNSSEC

You can verify DNSSEC-enabled domains using the DIG command by adding the "+dnssec" flag. For example:

$ dig +dnssec kodekloud.com
; <<>> DiG 9.18.28 <<>> +dnssec kodekloud.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56008
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;kodekloud.com.              IN      A

;; ANSWER SECTION:
kodekloud.com.               300     IN      A       172.67.68.105
kodekloud.com.               300     IN      A       104.26.11.250
kodekloud.com.               300     IN      A       104.26.10.250

;; Query time: 49 msec
;; SERVER: 10.255.255.254#53(10.255.255.254) (UDP)
;; WHEN: Thu Jan 23 22:35:27 CST 2025
;; MSG SIZE  rcvd: 90

In this example, while DNSSEC records are negotiated via the OPT record, they are not explicitly requested beyond that.

AWS Route 53 and DNSSEC Automation

When DNSSEC is enabled with AWS Route 53, the process is largely automated:

1. Key Generation: New DNSSEC keys are generated for your domain.
2. Key Publication: The public key is published as a DNSKEY record, enabling other servers to verify signatures.
3. Data Signing: DNS resource records are signed digitally using a zone signing key; the digital signatures are stored in RRSIG records.
4. Parent Zone Interaction: The parent zone or TLD is informed about the DNSSEC keys, establishing a trust chain from the root domain.

Once enabled, DNS responses will include RRSIG records, and supporting resolvers will verify these signatures. If validation fails, the response is deemed untrusted.

Summary

In summary, this article explains that:

• DoT and DoH secure DNS communication by encrypting the data using TLS/HTTPS protocols.
• DNSSEC enhances DNS security by digitally signing DNS records, ensuring the authenticity and integrity of data, thereby defending against spoofing and cache poisoning attacks.