Improving DNS Privacy with Oblivious DoH in 1.1.1.1
Dec 8, 2020Tanya Verma, Sudheesh Singanamalla, Marek Vavruša, Anbang Wen, Peter Wu
Summary
This post introduces Oblivious DNS over HTTPS (ODoH) as a new protocol to enhance DNS privacy. It details the ODoH message flow, involving three players: client, proxy, and target (resolver). ODoH uses HPKE for end-to-end encryption between the client and target, and TLS for communication between the client and proxy, and proxy and target. It leverages DNSSEC-validated public keys to authenticate the target. Initial performance measurements indicate a less than 1ms overhead at the 99th percentile compared to proxied DoH.
More from the DNS Infrastructure & Naming Conventions trail
- The keys to the Internet change on October 11, 2026. Are you ready?
- 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
- How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
- BGP ORIGIN attribute manipulation and its impact on the Internet
- Cloudflare Internal DNS is now generally available