{"id":2652,"date":"2019-07-31T13:01:29","date_gmt":"2019-07-31T13:01:29","guid":{"rendered":"https:\/\/blog.mozilla.org\/futurereleases\/?p=2652"},"modified":"2019-07-31T13:01:29","modified_gmt":"2019-07-31T13:01:29","slug":"dns-over-https-doh-update-detecting-managed-networks-and-user-choice","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/","title":{"rendered":"DNS-over-HTTPS (DoH) Update – Detecting Managed Networks and User Choice"},"content":{"rendered":"

At Mozilla, we are continuing to experiment with DNS-over-HTTPS (DoH), a new network protocol that encrypts Domain Name System (DNS) requests and responses. This post outlines a new study we will be conducting to gauge how many Firefox users in the United States are using parental controls or enterprise DNS configurations.<\/p>\n

With previous studies, we have tried to understand the performance impacts of DoH, and the results have been very promising. We found that DoH queries are <\/a>typically the same speed or slightly slower than DNS queries, and in some cases can be significantly faster. Furthermore, we found that web pages that are hosted by Akamai–a content distribution network, or \u201cCDN\u201d–<\/a>have similar performance when DoH is enabled. As such, DoH has the potential to improve user privacy on the internet without impeding user experience.<\/p>\n

Now that we\u2019re satisfied with the performance of DoH, we are shifting our attention to how we will interact with existing DNS configurations that users have chosen.\u00a0 For example, network operators often want to filter out various kinds of content. Parents and schools in particular may use “parental controls”, which block access to websites that are considered unsuitable for children. These controls may also block access to malware and phishing websites. DNS is commonly used to implement this kind of content filtering.<\/p>\n

Similarly, some enterprises set up their own DNS resolvers that behave in special ways. For example, these resolvers may return a different IP address for a domain name depending on whether the user that initiated the request is on a corporate network or a public network. This behavior is known as \u201csplit-horizon\u201d, and it is often to host a production and development version of a website. Enabling DoH in this scenario could unintentionally prevent access to internal enterprise websites when using Firefox.<\/p>\n

We want to understand how often users of Firefox are subject to these network configurations. To do that, we are performing a study within Firefox for United States-based users to collect metrics that will help answer this question. These metrics are based on common approaches to implementing filters and enterprise DNS resolvers.<\/p>\n

Detecting DNS-based parental controls<\/h2>\n

This study will generate DNS lookups from participants\u2019 browsers to detect DNS-based parental controls. First, we will resolve test domains operated by popular parental control providers to determine if parental controls are enabled on a network. For example, OpenDNS operates exampleadultsite.com<\/a>. It is not actually an adult website, but it is present on the blocklists for several parental control providers. These providers often block access to such websites by returning an incorrect IP address for DNS lookups.<\/p>\n

As part of this test, we will resolve exampleadultsite.com. According to OpenDNS, this domain name should only resolve to the address 146.112.255.155. Thus, if a different address is returned, we will infer that DNS-based parental controls have been configured. The browser will not connect to, or download any content from the website.<\/p>\n

We will also attempt to detect when a network has forced \u201csafe search\u201d versions of Google and YouTube for its users. The way that safe search works is that the network administrator configures their resolver to redirect DNS requests for a search provider to a \u201csafe\u201d version of the website. For example, a network administrator may force all users that look up www.google.com<\/a> to instead look up forcesafesearch.google.com. When the browser connects to the IP address for forcesafesearch.google.com, the search provider knows that safe search is enabled and returns filtered search results.<\/p>\n

We will resolve the unrestricted domain names provided by Google and YouTube from the addon, and then resolve the safe search domain names. Importantly, the safe search domain names for Google and YouTube are hosted on fixed IP addresses. Thus, if the IP address for an unrestricted and safe search domain name match, we will infer that parental controls are enabled. The tables below show the domain names we will resolve to detect safe search.<\/p>\n\n\n\n\n\n\n\n\n
YouTube<\/strong><\/td>\nGoogle<\/strong><\/td>\n<\/tr>\n
www.youtube.com<\/td>\nwww.google.com<\/td>\n<\/tr>\n
m.youtube.com<\/td>\ngoogle.com<\/td>\n<\/tr>\n
youtubeapi.googleapis.com<\/td>\n<\/td>\n<\/tr>\n
youtube.googleapis.com<\/td>\n<\/td>\n<\/tr>\n
www.youtube-nocookie.com<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Table 1: The unrestricted domain names provided by YouTube and Google<\/em><\/p>\n\n\n\n\n\n
YouTube<\/strong><\/td>\nGoogle<\/strong><\/td>\n<\/tr>\n
restrict.youtube.com<\/td>\nforcesafesearch.google.com<\/td>\n<\/tr>\n
restrictmoderate.youtube.com<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Table 2: The safe search domain names provided by YouTube and Google<\/em><\/p>\n

Detecting split-horizon DNS resolvers<\/h2>\n

We also want to understand how many Firefox users are behind networks that use split-horizon DNS resolvers, which are commonly configured by enterprises. We will perform two checks locally in the browser on DNS answers for websites that users visit during the study. First, we will check if the domain name does not contain a TLD that can be resolved by publicly-available DNS resolvers (such as .com). Second, if the domain name does<\/i> contain such a TLD, we will check if the domain name resolves to a private IP address<\/a>.<\/p>\n

If either of these checks return true, we will infer that the user\u2019s DNS resolver has configured split-horizon behavior. This is because the public DNS can only resolve domain names with particular TLDs, and it must resolve domain names to addresses that can be accessed over the public internet.<\/p>\n

To be clear, we will not collect any DNS requests or responses<\/b>. All checks will occur locally. We will count how many unique domain names appear to be resolved by a split-horizon resolver and then send only these counts to us.<\/p>\n

Study participation<\/h2>\n

Users that do not wish to participate in this study can opt-out by typing \u201cabout:studies\u2019 in the navigation bar, looking for an active study titled \u201cDetection Logic for DNS-over-HTTPS\u201d, and disabling it. (Not all users will receive this study, so don\u2019t be alarmed if you can\u2019t find it.) Users may also opt out of participating in any future studies from this page.<\/p>\n

As always, we are committed to maintaining a transparent relationship with our users. We believe that DoH significantly improves the privacy of our users. As we move toward a rollout of DoH to all United States-based Firefox users, we intend to provide explicit mechanisms allowing users and local DNS administrators to opt-out.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

At Mozilla, we are continuing to experiment with DNS-over-HTTPS (DoH), a new network protocol that encrypts Domain Name System (DNS) requests and responses. This post outlines a new study we … Read more<\/a><\/p>\n","protected":false},"author":653,"featured_media":2537,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"coauthors":[310623],"yoast_head":"\nDNS-over-HTTPS (DoH) Update - Detecting Managed Networks and User Choice - Future Releases<\/title>\n<meta name=\"description\" content=\"This post outlines a new study we will be conducting to gauge how many Firefox users in the United States are using parental controls or enterprise DNS configurations.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Selena Deckelmann\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/\",\"url\":\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/\",\"name\":\"DNS-over-HTTPS (DoH) Update - Detecting Managed Networks and User Choice - Future Releases\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.mozilla.org\/futurereleases\/files\/2018\/06\/Logo.png\",\"datePublished\":\"2019-07-31T13:01:29+00:00\",\"dateModified\":\"2019-07-31T13:01:29+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/#\/schema\/person\/a46713c9dcb379a33794c1d3cef4a3c4\"},\"description\":\"This post outlines a new study we will be conducting to gauge how many Firefox users in the United States are using parental controls or enterprise DNS configurations.\",\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/#primaryimage\",\"url\":\"https:\/\/blog.mozilla.org\/futurereleases\/files\/2018\/06\/Logo.png\",\"contentUrl\":\"https:\/\/blog.mozilla.org\/futurereleases\/files\/2018\/06\/Logo.png\",\"width\":1400,\"height\":770,\"caption\":\"Firefox Logo\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/futurereleases\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"DNS-over-HTTPS (DoH) Update – Detecting Managed Networks and User Choice\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/futurereleases\/\",\"name\":\"Future Releases\",\"description\":\"Be the first to know what's new with upcoming Firefox releases.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/futurereleases\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/#\/schema\/person\/a46713c9dcb379a33794c1d3cef4a3c4\",\"name\":\"Selena Deckelmann\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/futurereleases\/#\/schema\/person\/image\/29a47d4d79e418928d2203c32ea64ed0\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b722826f7bbb8baab22b6699065eb15c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b722826f7bbb8baab22b6699065eb15c?s=96&d=mm&r=g\",\"caption\":\"Selena Deckelmann\"},\"description\":\"Senior Manager, Security Engineering\",\"url\":\"https:\/\/blog.mozilla.org\/futurereleases\/author\/sdeckelmannmozilla-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"DNS-over-HTTPS (DoH) Update - Detecting Managed Networks and User Choice - Future Releases","description":"This post outlines a new study we will be conducting to gauge how many Firefox users in the United States are using parental controls or enterprise DNS configurations.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/","twitter_misc":{"Written by":"Selena Deckelmann","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/","url":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/","name":"DNS-over-HTTPS (DoH) Update - Detecting Managed Networks and User Choice - Future Releases","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/futurereleases\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/#primaryimage"},"image":{"@id":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.mozilla.org\/futurereleases\/files\/2018\/06\/Logo.png","datePublished":"2019-07-31T13:01:29+00:00","dateModified":"2019-07-31T13:01:29+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/futurereleases\/#\/schema\/person\/a46713c9dcb379a33794c1d3cef4a3c4"},"description":"This post outlines a new study we will be conducting to gauge how many Firefox users in the United States are using parental controls or enterprise DNS configurations.","breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/#primaryimage","url":"https:\/\/blog.mozilla.org\/futurereleases\/files\/2018\/06\/Logo.png","contentUrl":"https:\/\/blog.mozilla.org\/futurereleases\/files\/2018\/06\/Logo.png","width":1400,"height":770,"caption":"Firefox Logo"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/futurereleases\/2019\/07\/31\/dns-over-https-doh-update-detecting-managed-networks-and-user-choice\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/futurereleases\/"},{"@type":"ListItem","position":2,"name":"DNS-over-HTTPS (DoH) Update – Detecting Managed Networks and User Choice"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/futurereleases\/#website","url":"https:\/\/blog.mozilla.org\/futurereleases\/","name":"Future Releases","description":"Be the first to know what's new with upcoming Firefox releases.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/futurereleases\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/futurereleases\/#\/schema\/person\/a46713c9dcb379a33794c1d3cef4a3c4","name":"Selena Deckelmann","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/futurereleases\/#\/schema\/person\/image\/29a47d4d79e418928d2203c32ea64ed0","url":"https:\/\/secure.gravatar.com\/avatar\/b722826f7bbb8baab22b6699065eb15c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b722826f7bbb8baab22b6699065eb15c?s=96&d=mm&r=g","caption":"Selena Deckelmann"},"description":"Senior Manager, Security Engineering","url":"https:\/\/blog.mozilla.org\/futurereleases\/author\/sdeckelmannmozilla-com\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/posts\/2652"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/users\/653"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/comments?post=2652"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/posts\/2652\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/media\/2537"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/media?parent=2652"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/categories?post=2652"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/tags?post=2652"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/futurereleases\/wp-json\/wp\/v2\/coauthors?post=2652"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}