International Journal of System Design and Information Processing

Abstract

DNS over HTTPS (DoH) has emerged as a privacy-enhancing protocol that encrypts DNS queries within HTTPS traffic, preventing eavesdropping and manipulation by intermediaries. While it protects end-user privacy, DoH introduces operational challenges for enterprise network security. This paper evaluates the trade-offs associated with DoH deployment in managed corporate environments. We set up a testbed with controlled client devices, internal DNS servers, and third-party DoH resolvers. Using a dataset of 10,000 queries, we measure DNS query visibility in intrusion detection systems (IDS), latency changes, and detection efficacy for malware communication relying on domain generation algorithms (DGAs). Results show a 40% decrease in DNS-based malware detection accuracy when DoH is used with external resolvers, due to the inability of IDS systems to inspect encrypted DNS payloads. Latency increased by an average of 18ms but remained acceptable for end-user experience. We also evaluate the effectiveness of enterprise DoH resolvers and split-resolution policies to preserve visibility while enabling encryption. A hybrid deployment model is proposed, where corporate devices route DNS via secure DoH proxies under policy control, while personal or BYOD devices use public resolvers in guest VLANs. We conclude that while DoH enhances privacy, it must be strategically integrated with internal security controls to maintain visibility, compliance, and threat detection capabilities in enterprise networks.

Keywords

DNS, HTTPS (DoH), Enterprise Networks, Privacy Gains, Security Trade-offs.

References