DNS Query Privacy Revisited
blog.apnic.net
blog.apnic.net
The QNAME minimisation technique described in the article is about showing only partial requests to intermediate authorities in the DNS hierarchy. DNS over HTTPS can protect the request until it gets to the resolver, and then the QNAME minimisation system can hide it from interested intermediate DNS authorities. I guess in practice this means the .com servers can't tell whether someone is going to xxx.substack.com or yyy.substack.com just that they're asking about substack.
As the article points out, most users ask a shared DNS resolver to perform resolution for them, and if you want to, the Cloudflare public resolver 1.1.1.1 uses this technique.
If this isn't a smoking gun I don't know what is.
HE is the only entity on that list with a non-0% ratio who is also a backbone carrier -- i.e. their own routers have no 0.0.0.0/0 route.
Obviously there is tampering going on here; no sane DNS software includes an "if (rand()) { do_qname_minimization_today(); }". And, obviously, the tampering is happening at the carrier level. And you can bet the answer starts with a "Century" and ends with "Link".
From the blog I get the impression Geoff is not "raise a question as to what is happening here" about HE's 97%, but more about all the others with >0% & <97%.
Would you care to enlighten us with what you are implying?
The poster seems to think Century Link is involved in a fundamental way. Which admittedly, given their track record with hosing large swathes of the Internet these last couple years may not be unreasonable.
At least that was what I got out of it.
However, the "most popularly used" open resolver, Google's Public DNS, "does to not appear to support QNAME Minimisation".
Is anyone actually surprised by this, at all?
For longer tail stuff, you could use buckets. Cluster domains so only a few or ideally a single buckets need to be fetched. But make sure every bucket has multiple clusters.
"Give me the recipes and porn bucket please"
Given that the Internet wasn't made with the concept of nosy people as a adversary or threat, many adversaries have flocked to using the metadata as a gold mine instead of just ignoring it and passing it along. Which is half the reason it seems like we can't just have nice things.