{"id":2614,"date":"2019-04-02T22:21:50","date_gmt":"2019-04-02T22:21:50","guid":{"rendered":"https:\/\/blog.mozilla.org\/futurereleases\/?p=2614"},"modified":"2019-04-02T22:21:50","modified_gmt":"2019-04-02T22:21:50","slug":"dns-over-https-doh-update-recent-testing-results-and-next-steps","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/","title":{"rendered":"DNS-over-HTTPS (DoH) Update – Recent Testing Results and Next Steps"},"content":{"rendered":"

We are giving several updates on our testing with DNS-over-HTTPS (DoH), a new protocol that uses encryption to protect DNS requests and responses<\/a>. This post shares the latest results, what we\u2019ve learned, and how we\u2019re fine-tuning our next step in testing.<\/p>\n

tl;dr:<\/strong> The results of our last performance test showed improvement or minimal impact when DoH is enabled. Our next experiment continues to test performance with Akamai and Cloudflare, and adds a performance test that takes advantage of a secure protocol for DNS resolvers set up between Cloudflare and Facebook.<\/p>\n

What we learned<\/h3>\n

Back in November 2018, we rolled out a test of DoH in the United States to look at possible impacts to Content Delivery Networks<\/a> (CDNs). Our goal was to closely examine performance again, specifically the case when users get less localized DNS responses that could slow the browsing experience, even if the DNS resolver itself is accurate and fast. We worked with Akamai to help us understand more about the possible impact.<\/p>\n

The results were strong! Like our previous studies, DoH had minimal impact or clearly improved the total time it takes to get a response from the resolver and fetch a web page.<\/p>\n

Here\u2019s a sample result for our \u201ctime to first byte\u201d measurement:<\/p>\n

\"\"<\/a>In this case, the absolute difference across the experiment was less than 10ms regression for 50th percentile and lower. For 75th percentile or higher, we saw no regression or even a performance win, particularly on the long tail of slower connections. We saw very similarly shaped results for the rest of our measurements.<\/p>\n

While exploring the data in the last experiment, we discovered a few things we\u2019d like to know more about and will run three additional tests described below.<\/p>\n

Additional testing on performance and privacy<\/h3>\n

First, we saw a higher error rate during DNS queries than expected, with and without DoH. We\u2019d like to know more about those errors — are they something that the browser could handle better? This is something we\u2019re still researching, and this next experiment adds better error capturing for analysis.<\/p>\n

And while the performance was good with DoH, we\u2019re curious if we could improve it even more. CDNs and other distributed websites provide localized DNS responses depending on where you are in the network. The goal is to send you to a host near you on the network and therefore give you the best performance, but if your DNS goes through Cloudflare, this might not happen. The EDNS Client Subnet extension<\/a> allows a centralized resolver like Cloudflare to give the authoritative resolver for the site you are going to some information about your location, which they can use to tune their responses. Ordinarily this isn\u2019t safe for two reasons: first, the query to the authoritative resolver isn\u2019t encrypted and so it leaks your query; and second, the authoritative resolver might be operated by a third party who would then learn about your browsing activity. This was something we needed to test further.<\/p>\n

Since our last experiment, Facebook has partnered with Cloudflare<\/a> to offer DNS-over-TLS (DoT) as a pilot project, which plugs the privacy leak caused by EDNS Client Subnet (ECS) use. There are two key reasons this work improves your privacy when connecting to Facebook. \u00a0First, Facebook operates their own authoritative resolvers, so third parties don\u2019t get your query. Second, DoT encrypts your query so snoopers on the network can\u2019t see it.<\/p>\n

With DoT in place, we want to see if Cloudflare sending ECS to Facebook’s resolver results in our users getting better response times. To figure this out, we added tests for resolver response and web page fetch for test URLs from Facebook systems.<\/p>\n

The experiment will check locally if the browser has a Facebook login cookie. If it does, it will attempt to collect data once per day — about the speed of queries to test URLs. This means that if you have never logged into Facebook, the experiment will not fetch anything from Facebook systems.<\/p>\n

As with our last test, we aren\u2019t passing any cookies, these domains aren\u2019t ones that the user would automatically retrieve and just contain dummy content, so we aren\u2019t disclosing anything to the resolver or Facebook about users\u2019 browsing behavior.<\/p>\n

We\u2019re also re-running the Akamai tests to get to the bottom of the error messages issue.<\/p>\n

Here is a sample of the data that we are collecting as part of this experiment:<\/p>\n

\"\"<\/a><\/p>\n

The payload only contains timing and error information. For more information about how we are collecting telemetry for this experiment, read here<\/a>. As always, you can always see what data Firefox sends back to Mozilla in about:telemetry.<\/p>\n

We believe these DoH and DoT deployments are both exciting steps toward providing greater security and privacy to all. We\u2019re happy to support the work Cloudflare is doing that might encourage others to pursue DoH and DoT deployments.<\/p>\n

How will the next test roll out?<\/h3>\n

Starting the week of April 1, a small portion of our United States-based users in the Release channel will receive the DoH treatment. As before<\/a>, this study will use Cloudflare\u2019s DNS-over-HTTPS service and will continue to provide in-browser notifications about the experiment so that participants are fully informed and has the opportunity to decline.<\/p>\n

We are working to build a larger ecosystem of trusted DoH providers, and we hope to be able to experiment with other providers soon. As before, we will continue to share the results of the DoH tests and provide updates once future plans solidify.<\/p>\n","protected":false},"excerpt":{"rendered":"

We are giving several updates on our testing with DNS-over-HTTPS (DoH), a new protocol that uses encryption to protect DNS requests and responses. This post shares the latest results, what … Read more<\/a><\/p>\n","protected":false},"author":653,"featured_media":2537,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"coauthors":[310623],"yoast_head":"\nDNS-over-HTTPS (DoH) Update - Recent Testing Results and Next Steps - Future Releases<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Selena Deckelmann\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/\",\"url\":\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/\",\"name\":\"DNS-over-HTTPS (DoH) Update - Recent Testing Results and Next Steps - Future Releases\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.mozilla.org\/futurereleases\/files\/2018\/06\/Logo.png\",\"datePublished\":\"2019-04-02T22:21:50+00:00\",\"dateModified\":\"2019-04-02T22:21:50+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/#\/schema\/person\/a46713c9dcb379a33794c1d3cef4a3c4\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/#primaryimage\",\"url\":\"https:\/\/blog.mozilla.org\/futurereleases\/files\/2018\/06\/Logo.png\",\"contentUrl\":\"https:\/\/blog.mozilla.org\/futurereleases\/files\/2018\/06\/Logo.png\",\"width\":1400,\"height\":770,\"caption\":\"Firefox Logo\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/futurereleases\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"DNS-over-HTTPS (DoH) Update – Recent Testing Results and Next Steps\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/futurereleases\/\",\"name\":\"Future Releases\",\"description\":\"Be the first to know what's new with upcoming Firefox releases.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/futurereleases\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/#\/schema\/person\/a46713c9dcb379a33794c1d3cef4a3c4\",\"name\":\"Selena Deckelmann\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/#\/schema\/person\/image\/29a47d4d79e418928d2203c32ea64ed0\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b722826f7bbb8baab22b6699065eb15c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b722826f7bbb8baab22b6699065eb15c?s=96&d=mm&r=g\",\"caption\":\"Selena Deckelmann\"},\"description\":\"Senior Manager, Security Engineering\",\"url\":\"https:\/\/blog.mozilla.org\/futurereleases\/author\/sdeckelmannmozilla-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"DNS-over-HTTPS (DoH) Update - Recent Testing Results and Next Steps - Future Releases","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/","twitter_misc":{"Written by":"Selena Deckelmann","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/","url":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/","name":"DNS-over-HTTPS (DoH) Update - Recent Testing Results and Next Steps - Future Releases","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/futurereleases\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/#primaryimage"},"image":{"@id":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.mozilla.org\/futurereleases\/files\/2018\/06\/Logo.png","datePublished":"2019-04-02T22:21:50+00:00","dateModified":"2019-04-02T22:21:50+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/futurereleases\/#\/schema\/person\/a46713c9dcb379a33794c1d3cef4a3c4"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/#primaryimage","url":"https:\/\/blog.mozilla.org\/futurereleases\/files\/2018\/06\/Logo.png","contentUrl":"https:\/\/blog.mozilla.org\/futurereleases\/files\/2018\/06\/Logo.png","width":1400,"height":770,"caption":"Firefox Logo"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/04\/02\/dns-over-https-doh-update-recent-testing-results-and-next-steps\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/futurereleases\/"},{"@type":"ListItem","position":2,"name":"DNS-over-HTTPS (DoH) Update – Recent Testing Results and Next Steps"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/futurereleases\/#website","url":"https:\/\/blog.mozilla.org\/futurereleases\/","name":"Future Releases","description":"Be the first to know what's new with upcoming Firefox releases.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/futurereleases\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/futurereleases\/#\/schema\/person\/a46713c9dcb379a33794c1d3cef4a3c4","name":"Selena Deckelmann","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/futurereleases\/#\/schema\/person\/image\/29a47d4d79e418928d2203c32ea64ed0","url":"https:\/\/secure.gravatar.com\/avatar\/b722826f7bbb8baab22b6699065eb15c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b722826f7bbb8baab22b6699065eb15c?s=96&d=mm&r=g","caption":"Selena Deckelmann"},"description":"Senior Manager, Security Engineering","url":"https:\/\/blog.mozilla.org\/futurereleases\/author\/sdeckelmannmozilla-com\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/posts\/2614"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/users\/653"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/comments?post=2614"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/posts\/2614\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/media\/2537"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/media?parent=2614"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/categories?post=2614"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/tags?post=2614"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/coauthors?post=2614"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}