  Virtually every Internet communication typically involves a Domain Name
System (DNS) lookup for the destination server that the client wants to
communicate with. Operators of DNS recursive resolvers---the machines that
receive a client's query for a domain name and resolve it to a corresponding IP
address---can learn significant information about client activity. Past work,
for example, indicates that DNS queries reveal information ranging from web
browsing activity to the types of devices that a user has in their home.
Recognizing the privacy vulnerabilities associated with DNS queries, various
third parties have created alternate DNS services that obscure a user's DNS
queries from his or her Internet service provider. Yet, these systems merely
transfer trust to a different third party. We argue that no single party ought
to be able to associate DNS queries with a client IP address that issues those
queries. To this end, we present Oblivious DNS (ODNS), which introduces an
additional layer of obfuscation between clients and their queries. To do so,
ODNS uses its own authoritative namespace; the authoritative servers for the
ODNS namespace act as recursive resolvers for the DNS queries that they
receive, but they never see the IP addresses for the clients that initiated
these queries. We present an initial deployment of ODNS; our experiments show
that ODNS introduces minimal performance overhead, both for individual queries
and for web page loads. We design ODNS to be compatible with existing DNS
protocols and infrastructure, and we are actively working on an open standard
with the IETF.
