How a device finds encrypted DNS by itself

Discovering encrypted DNS endpoints can now occur automatically through a process known as Discovery of Designated Resolvers (DDR). This system allows a DNS resolver to publish necessary details, including a hostname, port, and protocol, to any device connected to it. However, this information cannot be determined by merely looking at the single IP address assigned to a device initially.

To initiate an encrypted DNS connection, a device queries for "_dns.resolver.arpa," a reserved name that responds with the resolver's encryption details if available. The device then selects the most preferred endpoint based on the resolver's offered protocols, which typically include DoH, DoT, and DoQ. If no encrypted endpoints are offered, the response explicitly indicates so.

Upon receiving a reply, the device establishes a new encrypted connection with the chosen endpoint for all subsequent queries. The specifics of the response, including which endpoints are available, depend on how the resolver is configured. Some resolvers apply the same settings to all users, while others offer profile-specific endpoints, which can include filters, allow lists, and logging settings relevant to the profile making the query.

A query arriving over an already encrypted connection automatically identifies itself, while those arriving over plain DNS lack such identification, relying instead on the source address for profiling. Resposnes include the IP addresses of available endpoints to prevent additional lookups, saving time and maintaining security by keeping the process within an encrypted connection.

Devices already established on encrypted connections, such as browsers using DoH or phones using DoT, can seamlessly upgrade to alternative protocols like DoH3 or DoQ. These upgrades inherit the security benefits of the existing connection. However, devices limited to plain DNS, like certain televisions, consoles, and appliances, initially require an unencrypted exchange, which can be read and potentially altered by network operators.

Consequently, clients may take advantage of this opportunity to upgrade when successful, but will revert to plain DNS if the upgrade fails. Stricter clients demand that the upgrade's certificate matches the original IP address to ensure continued security.

Directly configuring an encrypted resolver on a device remains preferable in situations where such settings are allowed, as it guarantees a secure connection from the outset and can be carried across different networks. Many routers now offer the capability to configure this encryption for all devices connected to them. DDR primarily benefits devices that do not fall under the reach of routers or other central configuration points.