Introduction
Internet privacy is a hot topic, especially concerning DNS query management. With the launch of the second public ODoH (Oblivious DNS over HTTPS) relay, it's now possible to anonymize your DNS queries without needing an account, thanks to an innovative solution using a single Rust binary.
Why is ODoH Necessary?
Traditional DNS resolvers, even privacy-focused ones like Pi-hole or AdGuard Home, expose your IP address to authoritative servers, meaning various services can track your browsing habits. Technologies like DoH and DoT encrypt the transport but don't solve the problem of who knows what about you.
Apple introduced a solution for its users with iCloud Private Relay, but it requires a paid subscription and is limited to Apple devices. Services like NextDNS and Cloudflare for Families require accounts or telemetry, which can be a barrier for those seeking a self-hosted solution.
How Does ODoH Work?
ODoH, or Oblivious DNS over HTTPS, is an IETF protocol (RFC 9230) that separates user identity from their DNS questions. The solution uses HPKE encryption to secure queries sent to a relay, which only sees your IP, while the destination server only sees the question.
Practical Functioning
- Encryption: The DNS query is encrypted under the target's HPKE public key. An ODoH relay receives this encrypted query.
- Relay: The relay sees your IP but not the DNS question, ensuring a separation of information.
- Target Server: The target server decrypts the question but does not know your IP.
- Response: The response is symmetrically encrypted and sent back along the same path, ensuring the relay only sees ciphertext.
Deploying the Second Public Relay
Setting up the second public ODoH relay was a technical challenge. Numa released a Rust binary that integrates both a client and a relay, simplifying the installation and operation process. The relay is configured to operate with a simple command (numa relay [PORT]), exposing only the necessary endpoints.
Challenges Faced
- Security: Using HPKE cryptographic primitives required rigorous audits to ensure security.
- Performance: Optimizing the relay to handle numerous simultaneous users while maintaining high privacy standards.
Conclusion
ODoH technology represents a significant advancement for those wishing to protect their online privacy without the hassle of accounts or subscriptions. With Numa's Rust binary, deploying an ODoH relay is now accessible to everyone.
Let's explore how this technology can transform your project. Let's discuss your project in 15 minutes.