It’s DNS, Jim, but not as we know it
summary
DNS is moving from UDP/53 to encrypted transports: RFC8484 (DoH) published Oct 2018 and DoT (DNS over TLS) is shipping (Android Pie uses it by default). Browsers (Firefox trial with Cloudflare 1.1.1.1; Chrome experimenting) start sending queries to trusted recursive resolvers, which breaks ISP split‑horizon, parental filters and some malware detection. Implementations to try now include getdns/stubby, Unbound and PowerDNS; DNSSEC root key rollover increased root KSK to 2k; expect operational and privacy trade‑offs.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 0:35Title
- 0:58RFC848
- 6:16Root servers
- 8:25Authority servers
- 9:27Recursive
- 13:33Stub Resolver
- 14:18DNS message format
- 20:10Query types
- 20:56TCP vs UDP
- 22:46DNS Flag Day
- 25:35RFC Client Subnet
- 28:31DNSSEC
- 29:37Root Key
- 31:32New Record Types
- 33:21Root Key Roll
- 34:23DMSSEC
- 35:31How can you use this
- 39:48Whos he Snowden
- 40:21RFC 785
- 41:46RFC 686
- 43:40Opportunistic
- 44:56Strict mode
- 46:46Supported platforms
- 50:43Dot is there
- 52:07Name minimization
- 53:01DNS is 30 years old
- 53:47DNS Camel
- 54:43More Fun DNS
- 58:02Back to Dot
related talks
46mPanel: DNS Privacy Vs.
01h 27mDNS at 30
27mDOH! Wait, what? DNS over https?
09mDNS is the entry point for every application on the internet
15mYou Depend on DNS, This Is How It Works and You Won't...
18mThe parts of DNS nobody explained to you
19mBuilding Privacy Into the Internet
12mHow DNS doesn’t work!