Google to Experiment ‘DNS over HTTPS’ (DoH) Feature in Chrome 78

Immediately after Mozilla announced its
plan to soon enable ‘DNS over HTTPS‘ (DoH) by default for
Firefox users in the United States, Google today says it is
planning an experiment with this privacy-focused technology in its
upcoming Chrome 78.

Under development since 2017, ‘DNS over
HTTPS^[2]‘ performs DNS
lookups—finding the server IP address of a certain domain name—over
an encrypted HTTPS connection to a DNS server, rather than sending
DNS queries in plaintext.

The protocol that sends DNS queries over secure HTTPS
connections has specifically been designed to prevent miscreants
from interfering with domain name lookups, eventually stopping
network observers, including your ISPs and attackers, from figuring
out what sites you visit.

Though the privacy-focused technology is also helpful in
preventing attackers from redirecting unsuspecting visitors to
phishing and malware sites, DNS over HTTPS could also bring its own
new challenges to the enterprise security solutions by making it
difficult to monitor network traffic for malicious
activities.

For the same reason, two months ago, the UK Internet Services
Providers’ Association (ISPA) nominated Mozilla for “Internet
villain of the year” award after the company added support for DoH
protocol in its Firefox browser that breaks DNS-based content
filters.

Enabling ‘DNS over HTTPS’ in Chrome 78

In a blog post
published today, Google said the company will add its
implementation of ‘DNS over HTTPS’ to the upcoming Chrome 78, which
is due for beta release in the next two weeks, and will enable the
feature for a fraction of users as an early-experiment,

The experimental feature will automatically upgrade the DNS
provider to the equivalent DoH service from the same provider if
the user’s current DNS provider is part of the list of known
DoH-compatible providers. If not in the list, Chrome will continue
to operate as it does today.

Chrome 78 users who want to manually opt-in or opt-out of the
experiment can change the flag settings at
chrome://flags/#dns-over-https.
However, it should be noted that Firefox by default upgrades users’
DoH server to Cloudflare and the setting needs to be changed
manually, for which it has been criticized, instead of upgrading to
a DoH server operated by the user’s current DNS provider, if
available.

Chrome Compatible’ DNS over HTTPS’ Providers

Google says it has selected some DNS providers for “their strong
stance on security and privacy, as well as the readiness of their
DoH services” and their agreement to participate in the test. The
list of providers currently include:
The experiment will run on all platforms for Chrome 78 users except
Linux and iOS, with the goals to validate the company’s
“implementation and to evaluate the performance impact.”

On Android 9 and later, if users have set a DNS-over-TLS^[4]
(DoT) provider in the private DNS settings, Chrome may attempt to
utilize DoH instead, but if an error occurred, the browser would
fall back to the DoT setting.

For those unaware, though DoH and DoT are separate standards for
encrypting DNS queries, the concept of both is the same.

What’re your thoughts on Google’s experiment of implementing
DoH? Let us know in the comment section below.

^[1][3]