What are the most recent DNS protocol updates?

The Domain Name System (DNS) is a vital component of the internet, translating human-readable domain names into numerical IP addresses. However, DNS is not a static protocol, and it undergoes constant updates and improvements to enhance its security, performance, and functionality. In this article, you will learn about some of the most recent DNS protocol updates and how they affect your computer networking skills.

Find expert answers in this collaborative article

Selected by the community from 6 contributions. Learn more

1 DNSSEC Deployment

DNSSEC (DNS Security Extensions) is a set of standards that add cryptographic signatures to DNS records, verifying their authenticity and preventing spoofing or tampering. DNSSEC has been gradually deployed across the internet since 2010, when the root zone was signed. However, DNSSEC adoption still faces some challenges, such as complexity, cost, and compatibility. One of the most recent DNS protocol updates is the introduction of a new root zone key signing key (KSK) in 2018, which required DNS operators and resolvers to update their trust anchors. Another update is the RFC 8624, published in 2019, which defines a mechanism for signaling DNSSEC validation status between recursive and authoritative servers.

Add your perspective

Mustafa Fahmy

Jr. Penetration Tester || Certificated ejptv2 || Cybersecurity Analyst || Offensive Security || THM top 5%🔝 || HTB || CTF Player 🚩
Report contribution
As of my last knowledge update in January 2022, the latest major update to the DNS protocol was DNS over HTTPS (DoH) and DNS over TLS (DoT), aimed at enhancing privacy and security.

Like
Yuvraj Singh

AI Security | Cybersecurity | EDR | SIEM | XDR | Lead @ OWASP Product Security Guide
Report contribution
DNS, the internet's phonebook, converts domain names to IP addresses. Without security measures like DNSSEC, it's prone to spoofing and hijacking. DNSSEC adds cryptographic protection, acting as a digital signature for domain names, ensuring authenticity. Deployment prevents Man-in-the-Middle attacks, builds trust, and enhances overall internet security. Challenges include configuration complexity, limited awareness, and cost considerations. Despite hurdles, DNSSEC is vital.

Like

2 DNS over HTTPS and TLS

DNS over HTTPS (DoH) and DNS over TLS (DoT) are two protocols that encrypt DNS queries and responses, protecting them from eavesdropping, interception, or manipulation. DoH and DoT enhance the privacy and security of DNS, but they also raise some concerns, such as centralization, compatibility, and policy implications. DoH and DoT have been gaining popularity and support from various browsers, operating systems, and service providers. Some of the most recent DNS protocol updates related to DoH and DoT are the RFC 8484, published in 2018, which specifies the DoH standard, and the RFC 8932, published in 2020, which provides operational guidance for DoT servers.

Add your perspective

Marlon Pires Nogueira

Infraestrutura de Redes TI | Telecom | Segurança da Informação | Treinamento
Report contribution
Olá! DNS sobre HTTPS (DoH) é um protocolo que permite a criptografia das consultas DNS usando o protocolo HTTPS, o mesmo utilizado para comunicações seguras na web. Isso ajuda a proteger contra monitoramento e manipulação de dados DNS. O DNS sobre TLS (DoT) é outra abordagem que utiliza o protocolo TLS para criptografar as comunicações DNS. Assim como o DoH, o DoT visa aumentar a privacidade e a segurança ao impedir que terceiros monitorem ou manipulem as consultas DNS. Ambas as abordagens visam resolver questões relacionadas à privacidade e segurança, garantindo que as consultas DNS não sejam facilmente interceptadas ou modificadas durante a transmissão. verifique fontes atualizadas, pois novas atualizações e melhorias podem ter ocorrido.

Translated

Like

3 DNS over QUIC

DNS over QUIC (DoQ) is an experimental protocol that uses QUIC (Quick UDP Internet Connections) as a transport layer for DNS. QUIC is a new protocol that combines the features of UDP and TCP, such as reliability, multiplexing, and congestion control. QUIC also offers encryption, fast connection establishment, and reduced latency. DoQ aims to leverage the benefits of QUIC for DNS, especially for mobile and low-latency scenarios. DoQ is still under development and testing, and it is not yet standardized. However, some of the most recent DNS protocol updates related to DoQ are the draft-ietf-dprive-dnsoquic-02, published in 2020, which describes the DoQ protocol, and the draft-huitema-quic-dnsoq-transport-03, published in 2021, which discusses the transport aspects of DoQ.

Add your perspective

Yuvraj Singh

AI Security | Cybersecurity | EDR | SIEM | XDR | Lead @ OWASP Product Security Guide
Report contribution
DNS over QUIC merges the DNS with the QUIC transport layer protocol. DNS translates domain names into IP addresses, while QUIC boosts internet communication performance and security. DoQ encapsulates DNS messages in QUIC packets, ensuring secure and efficient DNS resolution. Developed by Google, QUIC minimizes latency and enhances security compared to traditional TCP. Benefits include improved performance, enhanced security with encryption, reduced latency through multiplexing, resilience to network changes, and firewall traversal capabilities. Challenges in compatibility, deployment, and standardization may hinder widespread adoption, but as the internet evolves, it is a promising solution for efficient and secure DNS resolution.

Like

4 DNS Cookies

DNS Cookies are a mechanism that allows DNS clients and servers to exchange small pieces of data that can be used to identify and authenticate each other. DNS Cookies can help mitigate various types of DNS attacks, such as denial-of-service, amplification, or spoofing. DNS Cookies are based on a cryptographic hash of the IP addresses, ports, and a secret key. DNS Cookies have been standardized in RFC 7873, published in 2016, but they have been updated and extended by several subsequent RFCs. Some of the most recent DNS protocol updates related to DNS Cookies are the RFC 9018, published in 2021, which defines a new DNS Cookie option for EDNS (Extended DNS), and the RFC 8769, published in 2020, which specifies how to use DNS Cookies with DoT.

Add your perspective

5 DNS Push Notifications

DNS Push Notifications are a feature that allows DNS clients to subscribe to updates from DNS servers, instead of polling them periodically. DNS Push Notifications can improve the efficiency and responsiveness of DNS, especially for dynamic or frequently changing records. DNS Push Notifications use a persistent connection between the client and the server, and they can be implemented over various transport protocols, such as HTTP/2 or QUIC. DNS Push Notifications have been proposed in draft-ietf-dnssd-push-25, published in 2020, which defines the protocol for DNS Push Notifications for DNS-SD (DNS Service Discovery), a technique that uses DNS to discover and advertise network services.

Add your perspective

Yuvraj Singh

AI Security | Cybersecurity | EDR | SIEM | XDR | Lead @ OWASP Product Security Guide
Report contribution
DNS Push Notifications enable real-time updates for DNS data changes. Instead of relying on periodic queries, servers push updates to clients when records change. This reduces latency, improves efficiency, and enhances the responsiveness of DNS systems. Implementing DNS Push Notifications requires server and client support, ensuring a more dynamic and synchronized DNS infrastructure, particularly beneficial for rapidly changing environments.

Like

6 DNS Adaptive Refresh

DNS Adaptive Refresh is a technique that allows DNS clients to adjust the frequency of their queries based on the observed changes in the DNS records. DNS Adaptive Refresh can reduce the network traffic and the load on the DNS servers, while maintaining the freshness and accuracy of the DNS data. DNS Adaptive Refresh relies on a feedback loop between the client and the server, using EDNS options or DNS Push Notifications. DNS Adaptive Refresh has been proposed in draft-ietf-dnsop-adaptive-refresh-00, published in 2020, which describes the algorithm and the parameters for DNS Adaptive Refresh.

Add your perspective

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

Add your perspective

Load more contributions

What are the most recent DNS protocol updates?

1

2

3

4

5

6

7

1 DNSSEC Deployment

2 DNS over HTTPS and TLS

3 DNS over QUIC

4 DNS Cookies

5 DNS Push Notifications

6 DNS Adaptive Refresh

7 Here’s what else to consider

Computer Networking

Rate this article

Thanks for your feedback

More articles on Computer Networking

More relevant reading

What are the most recent DNS protocol updates?

1

2

3

4

5

6

7

1 DNSSEC Deployment

2 DNS over HTTPS and TLS

3 DNS over QUIC

4 DNS Cookies

5 DNS Push Notifications

6 DNS Adaptive Refresh

7 Here’s what else to consider

Computer Networking

Rate this article

Thanks for your feedback

Explore Other Skills