Encryption Adds a Slight Twist<\/h3>\n
The rise of encrypted traffic, driven by protocols like HTTPS, significantly affects DNS operations. Did you know that over 80% of all Internet traffic is encrypted, and about 95% of all web traffic is encrypted?<\/p>\n
![](\"\/wp-content\/uploads\/infoblox-blog-dns-mttrs-https-and-svcb-resource-records-and-their-importance-to-communications-service-providers-one.png\")
<\/p>\n
Encrypted data obscures DNS requests, posing challenges for CSPs to inspect and filter malicious content. To address this, CSPs must embrace advanced DNS security measures such as DNS over HTTPS (DoH) and DNS over TLS (DoT).<\/p>\n
- \n
- DNS over HTTPS (DoH)<\/b> sends DNS data through HTTPS connections, leveraging its encryption to enhance privacy and security. It benefits from HTTPS’s widespread adoption and can use standard ports, making it difficult to block.<\/li>\n
- DNS over TLS (DoT)<\/b> encrypts DNS data via TLS connections. Unlike DoH, it operates on separate ports, simplifying identification and troubleshooting.<\/li>\n<\/ul>\n
So, what is the twist?\u00a0 More operating systems, browsers and apps are using encryption. Whether it is HTTPS, DoH, or DoT, creating these secure connections requires more steps and back-and-forth communication between the client and server. Let\u2019s break it down a bit. At first, the client asks DNS for the server’s IP address. After getting the IP, the client then must set up a secure connection by engaging in a series of interactions with the server, known as the TLS handshake. During this handshake, both sides negotiate encryption settings and exchange certificates to ensure secure communication.<\/p>\n
![](\"\/wp-content\/uploads\/infoblox-blog-dns-mttrs-https-and-svcb-resource-records-and-their-importance-to-communications-service-providers-two.png\")
<\/p>\nThat adds time. And for impatient subscribers, can create a false perception that the network is slow.\u00a0<\/p>\n
DNS MTTRS: HTTPS and SVCB Shake Up Secure Traffic!<\/h3>\n
HTTPS and SVCB are two new DNS record types standardized by the Internet Engineering Task Force (IETF) in November 2023 to improve DNS functionality, particularly for encrypted traffic.<\/p>\n
- \n
- HTTPS Resource Records (HTTPS RRs; also known as Type 65)<\/b> enhance secure connection performance by offering more server details beyond just IP addresses. They include information like cryptographic algorithms, certificate details, and other parameters important for secure connections, unlike traditional DNS records.<\/li>\n
- Service Binding (SVCB RRs; also known as Type 64) <\/b>Resource Records extend HTTPS RRs, providing more flexibility in configuring secure connections. SVCB RRs let servers convey multiple sets of preferences to clients, including alternate certificates and supported protocols, enhancing efficiency in secure connection setups.<\/li>\n<\/ul>\n
![](\"\/wp-content\/uploads\/infoblox-blog-dns-mttrs-https-and-svcb-resource-records-and-their-importance-to-communications-service-providers-three.png\")
<\/p>\nHTTPS and SVCB Resource Records offer significant benefits for DNS functionality.<\/p>\n
- \n
- HTTPS Resource Records enhance security by embedding SSL\/TLS certificates in DNS responses, ensuring secure domain resolution, and protecting against potential attacks. Additionally, they contribute to improved performance by reducing the number of roundtrips required to establish secure connections, resulting in lower latency and a better user experience.<\/li>\n
- But SVCB Resource Records provide flexibility and efficiency by letting CSPs specify multiple alternative services and endpoints for a domain. This enhances service delivery flexibility and resource utilization while also reducing latency by enabling efficient service selection and decreasing connection establishment time, ultimately enhancing overall network responsiveness.<\/li>\n<\/ul>\n
Without HTTPS and SVCB Resource Records, the client may need to make more requests to fetch necessary security information or certificates. This can lead to increased latency and a longer time to establish a secure connection, negatively affecting the user experience, especially in scenarios where low latency is important, such as loading web pages quickly or streaming media seamlessly. And I mentioned earlier, this can lead to a false subscriber perception of slow network speeds.<\/p>\n
HTTPS and SVCB Resource Records provide benefits, but CSPs should weigh potential drawbacks:<\/p>\n
- \n
- Increased Processing Overhead: HTTPS encryption and decryption could strain server performance.<\/li>\n
- Compatibility Concerns: Legacy systems may struggle with or lack support for these advanced DNS records, causing connectivity issues for some users.<\/li>\n<\/ul>\n
Interact with our experts!<\/h3>\n
DNS MTTRS! And these new records play an important role in enabling CSPs to deliver smooth communication services. With the increasing prevalence of encrypted traffic and the emergence of technologies like HTTPS and SVCB Resource Records, CSPs must remain proactive. By embracing advanced DNS solutions that focus on both security and performance, CSPs can effectively adapt to the evolving digital landscape. Considering these factors will empower CSPs to offer users reliable and secure communication services. To dig deeper into this topic, I recommend watching our recent webinar, which provided detailed insights into HTTPS and SVCB Resource Records<\/a>. And as always, if you\u2019d like to talk to one of our local experts on the topic, please contact me and I will be happy to make the connection!<\/p>\n
- Service Binding (SVCB RRs; also known as Type 64) <\/b>Resource Records extend HTTPS RRs, providing more flexibility in configuring secure connections. SVCB RRs let servers convey multiple sets of preferences to clients, including alternate certificates and supported protocols, enhancing efficiency in secure connection setups.<\/li>\n<\/ul>\n
- DNS over TLS (DoT)<\/b> encrypts DNS data via TLS connections. Unlike DoH, it operates on separate ports, simplifying identification and troubleshooting.<\/li>\n<\/ul>\n