Google recently announced its DNS Over HTTPS (DoH) official service generally available, and fully supports RFC 8484 document.
Google launched in 2009, Google Public DNS, DNS Over HTTPS and launched on this basis in 2016, this is an experimental service, aimed at strengthening the security of the DNS, after the service entrance is dns.google.com/experimental .
Now Google has officially announced the DoH generally available, and fully supports RFC 8484 document, while continuing to provide support for the 2016 launch of the JSON API. The user can use the DNS parse DoH dns.google domain, which contains the same conventional DNS service anycast address, such as 8.8.8.8. The new access entry are:
- https://dns.google/dns-query (RFC 8484 – GET and POST)
- https://dns.google/resolve (JSON API – GET)
Google also said that it is abandoned previous / Internet draft experimental URL path to the DoH and dns.google.com support, and will end support for them in a few months. "With Google Public DNS, we are committed over TLS (DoT) to provide fast, private and secure DNS resolution by the DoH and DNS", Google introduced: "We plan to support JSON API, until there is a similar webapp friendly DoH standards. "
For developers, the GA version of the DoH to use the service, you need to configure the application to use the new DoH access entrance and properly handle HTTP 4xx error and 3xx redirect status codes, as follows:
- Applications need to use dns.google instead dns.google.com. Dns.google can query directly in the Google Public DNS address, without the need for additional DNS queries.
- Use Older / experimental Internet Draft DoH API developers need to switch to the new / dns-query URL path and make sure the full RFC 8484 compliance. Older early drafts API uses DoH standards in function accepts a query, these functions are rejected new API.
- Use JSON API developers can use two new GET parameters that can be used for DNS / DoH agent or DNSSEC-aware applications.
Specific technical details can be viewed DoH document , Google view the full announcement:
https://security.googleblog.com/2019/06/google-public-dns-over-https-doh.html