Modulelessen (2/3)
ODoH e DDR
ODoH and DDR
Oblivious DoH (ODoH) uses a proxy and a target resolver so that, under the design assumptions, neither one sees both the client’s network identity and the plaintext query. The proxy can see the client but not the encrypted query; the target can answer the query but should not learn the client address from that request. Collusion or traffic correlation can weaken the separation.
Discovery of Designated Resolvers (DDR) lets a client discover encrypted DNS service information for a resolver it already knows, using an authenticated process. Discovery is not the same as anonymity, and clients must verify that they are talking to the intended service.
These mechanisms do not remove the need to choose trustworthy operators, protect metadata, or validate DNS data. ODoH is specified as experimental.
References: RFC 9230 — ODoH, Experimental · RFC 9462 — DDR
Check your understanding
Choose the best answer. The examples use training names and do not send real DNS queries.
What is ODoH designed to do?