  The DNS HTTPS resource record is a new DNS record type designed for the
delivery of configuration information and parameters required to initiate
connections to HTTPS network services. It provides the ability to perform zone
apex redirection to a third-party provider, which the existing CNAME record
cannot do. In addition, it is a key enabler for TLS Encrypted ClientHello (ECH)
by providing the cryptographic keying material needed to encrypt the initial
exchange. To understand the adoption and security of this new DNS HTTPS record,
we perform a longitudinal study on the server-side deployment of DNS HTTPS for
Tranco top 1 million domains over 8 months, as well as the client-side support
for DNS HTTPS from major browsers. To the best of knowledge, our work is the
first longitudinal study on DNS HTTPS server deployment, and the first known
study on client-side support for DNS HTTPS. Despite the rapidly growing trend
of DNS HTTPS adoption, our study highlights concerns in the deployment by both
servers and clients, such as the complexity in properly maintaining HTTPS
records and the concerning hardfail mechanisms in browser when using HTTPS
records.
