Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Exploring the Ecosystem of DNS HTTPS Resource Records: An End-to-End Perspective

Hongying Dong, Yizhe Zhang, Hyeonmin Lee, Shumon Huque, Yixin Sun

TL;DR

This work performs a longitudinal study on the server-side deployment of DNS HTTPS for Tranco top million domains, as well as an analysis of the client-side support for DNS HTTPS through snapshots from major browsers.

Abstract

The DNS HTTPS resource record is a new DNS record type designed for the delivery of configuration information and parameters required to initiate connections to HTTPS network services. In addition, it is a key enabler for TLS Encrypted ClientHello (ECH) by providing the cryptographic keying material needed to encrypt the initial exchange. To understand the adoption of this new DNS HTTPS record, we perform a longitudinal study on the server-side deployment of DNS HTTPS for Tranco top million domains, as well as an analysis of the client-side support for DNS HTTPS through snapshots from major browsers. To the best of our knowledge, our work is the first longitudinal study on DNS HTTPS server deployment, and the first known study on client-side support for DNS HTTPS. Despite the rapidly growing trend of DNS HTTPS adoption, our study highlights challenges and concerns in the deployment by both servers and clients, such as the complexity in properly maintaining HTTPS records and connection failure in browsers when the HTTPS record is not properly configured.

Exploring the Ecosystem of DNS HTTPS Resource Records: An End-to-End Perspective

TL;DR

This work performs a longitudinal study on the server-side deployment of DNS HTTPS for Tranco top million domains, as well as an analysis of the client-side support for DNS HTTPS through snapshots from major browsers.

Abstract

The DNS HTTPS resource record is a new DNS record type designed for the delivery of configuration information and parameters required to initiate connections to HTTPS network services. In addition, it is a key enabler for TLS Encrypted ClientHello (ECH) by providing the cryptographic keying material needed to encrypt the initial exchange. To understand the adoption of this new DNS HTTPS record, we perform a longitudinal study on the server-side deployment of DNS HTTPS for Tranco top million domains, as well as an analysis of the client-side support for DNS HTTPS through snapshots from major browsers. To the best of our knowledge, our work is the first longitudinal study on DNS HTTPS server deployment, and the first known study on client-side support for DNS HTTPS. Despite the rapidly growing trend of DNS HTTPS adoption, our study highlights challenges and concerns in the deployment by both servers and clients, such as the complexity in properly maintaining HTTPS records and connection failure in browsers when the HTTPS record is not properly configured.
Paper Structure (94 sections, 14 figures, 9 tables)

This paper contains 94 sections, 14 figures, 9 tables.

Table of Contents

  1. Introduction
  2. Key contributions.
  3. Artifact availability.
  4. Background
  5. DNS HTTPS records.
  6. TLS Encrypted Client Hello (ECH).
  7. Tranco list.
  8. Research Overview
  9. (1) Server-side HTTPS record deployment
  10. (2) Client-side HTTPS record support
  11. Server-side HTTPS RR Deployment
  12. Datasets
  13. Scanning framework.
  14. Analyzing domains in the Tranco list.
  15. HTTPS RR Adoption
  16. ...and 79 more sections

Figures (14)

  • Figure 1: An example of HTTPS records.
  • Figure 2: Percentages of apex/www domains that publish HTTPS records. Vertical dashed line (on August 1st, 2023) denotes the source change of the Tranco list.
  • Figure 3: Number of non-Cloudflare DNS providers employed by domains that activate HTTPS records.
  • Figure 4: Percentage of domains based on the average duration of their ECH configuration.
  • Figure 5: Percentages of HTTPS records with RRSIG (solid line), RRSIG and AD bit (dashed line). Vertical dashed line (on August 1st, 2023) denotes Tranco source change.
  • ...and 9 more figures