I work in cyber security so I’m already embarrassed to not know this. But I do know how DNS works. I just don’t understand what people mean when they say “secure DNS”. Ive tried looking it up, but it keeps falling flat on me.
I use nextdns on my computer and phone, but I still don’t know what it’s doing, how it works, or anything. Can you explain what makes services like nextDNS secure, or why people change or even have different DNS servers configured?
In: Technology
I’ll break this into two parts.
What is secure DNS: Standard DNS is a simple query to a DNS server, unencrypted plain text. Anyone listening can see who is going to what website simply by seeing what DNS requests are made. If a computer makes a DNS request to get an IP for [Google.com](http://Google.com), they are like visiting [Google.com](http://Google.com) etc.
Secure DNS is encrypted, either using HTTPS for DNS over Https (DoH), TLS for DNS over TLS (DoT) or the new one DNS over Quic, which I think it still SSL somehow but I’m not sure. Like the difference between HTTP and HTTPS, someone watching network traffic can see a DNS request was made and to what server, but they can’t tell what you looked up. DoH is nice in that as it is HTTPS traffic so it blends right in with HTTPS. Its hard to tell whats a DNS request over HTTPS vs a standard web request to view a webpage.
As for why people have different servers, sometimes its speed, sometimes its security, sometimes its privacy. Many people by default use the DNS servers setup by their ISP. That means the ISP has logs of every DNS request, and therefor every website you visited and when. Switch DNS providers and they don’t have that log anymore. Encrypt the traffic and they can’t even try to watch it. Sometimes its security, some DNS providers (Like cloud flares 1.1.1.2) have malware protection, and will not answer DNS requests to known malware sites, or adult sites, or even enforce safe search via DNS. And sometimes it’s just speed. One DNS server might answer requests in 100ms, one 50ms.
EDIT: Not really ELIF in hindsight, but EL I’m in Cybersecurity is good enough I guess.
Latest Answers