  In this paper, we present the design, implementation, and analysis of DNS
over CoAP (DoC), a new proposal for secure and privacy-friendly name resolution
of constrained IoT devices. We implement different design choices of DoC in
RIOT, an open-source operating system for the IoT, evaluate performance
measures in a testbed, compare with DNS over UDP and DNS over DTLS, and
validate our protocol design based on empirical DNS IoT data. Our findings
indicate that plain DoC is on par with common DNS solutions for the constrained
IoT but significantly outperforms when additional standard features of CoAP are
used such as caching. With OSCORE, we can save more than 10 kBytes of code
memory compared to DTLS, when a CoAP application is already present, and retain
the end-to-end trust chain with intermediate proxies, while leveraging features
such as group communication or encrypted en-route caching. We also discuss a
compression scheme for very restricted links that reduces data by up to 70%.
