Both Mozilla and Google are rolling out some version of DNS-over-HTTPS (DoH) in their respective web browsers, Firefox and Chrome. Internet service providers and others are up in arms. This post will try to explain why at least two of the criticisms–on privacy and competition grounds–don’t make a lot of sense. The technical arguments, on the other hand, may have merit, but we’ll leave those issues to the experts.
Background
The Domain Name System (DNS) is what turns domain names, like cnn.com, into IP addresses, like 151.101.129.67. The internet runs on IP addresses, but obviously it is very convenient for people to use domain names instead–DNS allows this.
Typically DNS is configured at a network level, or at a device level. That means that there will be an IP address registered with your router at home, for instance, and that IP address is where your computer will direct DNS requests–that is, your computer will send a domain name to whatever is the entry for the DNS server, and get an IP address back. You can override your network’s DNS server setting on your computer or device and have it use a different server if you like.
Almost no one, it should be noted, changes their DNS defaults. So most home users at least just use their ISP’s default DNS settings. Some third-party DNS services offer enhanced features–for instance, parental controls (not returning IP addresses for adult websites)–so some people do change their DNS for those features, or to third-party DNS from Cloudflare or Google that can be at times faster. And corporate IT network guys of course do all kinds of custom stuff with DNS. But it is still a somewhat esoteric thing–network plumbing that most people don’t worry about.
There are three things that are different about DoH, as implemented by Google and Mozilla. (Their implementations are different from each other–Google’s rollout is fairly limited and experimental and will default to using a user’s existing DNS provider where possible, while Mozilla’s will send all Firefox DNS requests to Cloudflare, at least until further providers are certified. But these distinctions are not necessarily germane to the points raised in this post.) First, DoH is encrypted. That means that, unlike standard DNS, no one intercepting the traffic can see what domains a user is looking up. Second, they are sent over HTTPS–the same protocol that is used for standard web traffic. This means that DoH traffic “looks like” normal web traffic. DNS-over-TLS, a different standard, is just as secure from eavesdropping as DoH, but is easier for network managers to control (or block). Third, DoH is being implemented at the application level–by browsers themselves. Typically, as mentioned above, DNS settings are network or device level, and applications just plug into whatever the existing settings are. Browsers are obviously complex and heavily used applications, but they are still just applications like a calculator app or a word processor, and having an application take over for itself a function like DNS is somewhat unusual.
This post isn’t intended to weigh the pros and cons of DoH on a technical level, or even to assess its implications on broader cybersecurity issues such as malware prevention, all of which are discussed in many places online. DoH may be a total disaster for any number of reasons, or the best thing for the internet since the web itself. But none of that has any bearing on whether DoH itself results in users being tracked more or less, or is or is not a competition problem.
Privacy
The fundamental privacy gain from DoH is pretty simple: For most users, their DNS requests were not encrypted, and now they will be.
That doesn’t answer every privacy question, of course, because encryption just prevents eavesdropping–your DNS query starts in your web browser and goes to the DNS server, and no one in between can see it. But, it doesn’t prevent the DNS service itself, or your web browser, from tracking your user activity.
As to the second issue: These are web browsers we are talking about. They already can see all the websites you’re visiting, and these DNS changes don’t give them any extra visibility into your internet activity. It’s the exact same data they already have. Any notion, then, that DoH allows Mozilla or Google to track users more is simply wrong. Google in particular might be tracking more than its users might like! But that doesn’t change because of the new DNS protocol.
Of course, if your web browser is sending your DNS requests to some third party, that third party does gain the ability to track your internet usage–but both Firefox and Google have measures in place to prevent this. Firefox will only use DNS services that it has ensured don’t engage in tracking, and Google, for now at least, is using a user’s existing DNS provider (only switching to DoH instead of normal unencrypted DNS), so there is at least no change in DNS privacy from the provider end there.
Finally, it’s worth noting that even if ISPs lose visibility into DNS queries, they don’t lose the ability to track users altogether. They can still monitor the contents of all unencrypted internet use, for instance, and they can still see what IP addresses a given user is connected to, even if this data is less granular than what they can get from DNS (or from DNS plus other forms of monitoring).
Overall, in addition to the gains that come from encryption itself, the use of DNS-over-HTTPS might increase user privacy, since most people use their ISP’s DNS, and ISPs do in fact use DNS to track users. Using third-party DNS, in general, is a good way to prevent ISP tracking. That said, most users don’t know how to change the DNS servers on their router or device, or realize that this is even something they might want to do at all, so having at least some of a user’s DNS traffic sent via a more secure channel seems like a privacy win (one shared by other encrypted DNS techniques, such as the aforementioned DNS-over-TLS).
Competition
Google is obviously the biggest player in online advertising, and its matchless ability to collect user data is one key part of this. As I said above, though, these DNS changes don’t give browser makers any meaningful increased ability to gather this data. But changes to DNS could affect others’ (such as ISP’s) ability to collect data–and this could have competitive dimensions.
But I think these fears are misplaced, as well. In the first place Google’s particular DoH implementation doesn’t result in ISPs losing DNS data, since it will continue using ISP DNS servers, just using DoH instead of standard DNS. Mozilla’s changes do necessarily mean less ISP tracking–but there’s no competition harm there, as Mozilla already doesn’t do web tracking or online ads. But let’s put that aside to work through the argument–what if Google switched every Chrome user to Google DNS, overnight?
It is hard to get too worked up about ISPs losing some ability to track users, even if this has competitive effects elsewhere, such as in online advertising. I don’t like tracking. This means that I like things that make tracking harder. True, I would like tracking to be harder for everyone–for browser makers, for social networks, for online advertisers–but it seems hard to prioritize concerns about harms to some market that also carry such a pro-privacy upside. The way to deal with an allegedly uneven playing field is with a comprehensive privacy law that limits tracking, not increases competition over who can exploit your browsing history most profitably.
The other potential competitive harm is to DNS itself. But this seems overstated as well. Users still have the ability to set their own custom DNS settings at a network and device level, and the added step of turning off DoH in their browsers, if that is even necessary, isn’t much of an incremental technical hurdle. Additionally, both Mozilla and Google have designed their implementations to not interfere with a user’s custom DNS settings if the user, for instance, is using OpenDNS or some other third-party DNS service that features content controls. Finally, while there is a market for third-party DNS services, the overwhelming majority of users don’t even know what DNS is, and just stick with defaults–and those users that do switch their DNS services usually switch to a free third-party service like Google DNS or Cloudflare DNS. Given the facts of DNS, the competitive effect of these technical choices by Mozilla and Google are likely to be minimal.
Conclusion
Google’s power in the browser, online content, and online advertising industries is significant. And Mozilla’s influence on the industry and users remains very strong. Power in those areas can have real impacts on competitors and consumers. That’s why we are working hard on identifying and advocating for new laws to promote competition in digital platforms, as well as enforcing our existing laws to the fullest extent. DoH might raise technical issues from a network administration or other perspective, but its effects on user tracking and competition are overstated.