Who is answering my queries
Baojun Liua, Chaoyi Lua, Haixin Duana, Ying Liua, Zhou Lib, Shuang Haoc, Min Yangd
- aTsinghua University/BNRist
- bUniversity of California
- cUniversity of Texas at Dallas
- dFudan University
Papers open inside SciRah from the original publisher or repository; SciRah never hosts them.
Abstract
DNS is a critical service for almost all Internet applications. DNS queries from end users are handled by recursive DNS servers for scalability. For convenience, Internet Service Providers (ISPs) assign recursive servers for their clients automatically when the clients choose the default network settings. On the other hand, users should also have the flexibility to use their preferred recursive servers, like public DNS servers. Since almost all DNS queries are sent in plain-text, it's possible for on-path devices to intercept DNS queries sent to public resolvers, by spoofing the IP addresses of user-specified DNS servers and surreptitiously responding using alternative resolvers instead. The trust relationship between users and public DNS are thus broken by the hidden interception of the DNS resolution path (which we term as DNS interception).