Last year, I noticed a significant increase in DNS resolution times for a critical service of one of my clients. Initially, I suspected a problem at the network layer, but detailed investigations revealed that the root cause was the newly deployed Secure DNS service. This situation clearly demonstrated the direct impact of a choice made for privacy and security on performance.
Secure DNS mechanisms were developed to address the weaknesses of traditional DNS; however, these improvements often come with additional protocol layers and encryption, which naturally create a performance cost. Especially in high-volume and low-latency systems, understanding and managing this trade-off correctly is critically important.
What is Traditional DNS and What are its Security Issues?
The Domain Name System (DNS) is like the internet’s phone book; it translates domain names (e.g., mustafaerbay.com) into IP addresses (e.g., 192.0.2.42). Traditional DNS queries are sent as unencrypted plain text over UDP or TCP. This design, dating back to the 80s, is insufficient to meet today’s security requirements.
Unencrypted DNS queries allow attackers to eavesdrop on network traffic to see which sites you visit or to redirect you to fake sites through attacks like DNS spoofing. This poses a serious privacy and security risk, especially on public Wi-Fi networks or untrusted ISPs. These weaknesses have become unacceptable in modern network architectures, accelerating the shift towards Secure DNS solutions.
What are Secure DNS Technologies?
The concept of Secure DNS fundamentally encompasses various technologies that enhance security by encrypting or authenticating DNS queries and responses. The three most commonly used and discussed technologies are DNS over HTTPS (DoH), DNS over TLS (DoT), and DNSSEC. Each has different application areas and benefits.
DNS over HTTPS (DoH)
DoH embeds DNS queries within standard HTTPS traffic and sends them over port 443. This way, DNS traffic is encrypted in the same manner as regular web traffic, making it harder to monitor or block. One of DoH’s biggest advantages is that DNS queries are “hidden” within network traffic and cannot be easily distinguished by DPI (Deep Packet Inspection) devices. This feature is particularly preferred in regions with heavy censorship or to prevent ISPs from manipulating DNS traffic.
Many modern web browsers (Chrome, Firefox, Edge) offer DoH support by default and, in some cases, automatically switch to secure DNS providers. This is a significant step for end-users in terms of privacy and security but can also bring certain challenges in corporate networks, as network administrators may lose the ability to inspect DNS traffic.
DNS over TLS (DoT)
DoT directly encrypts DNS queries over the TLS (Transport Layer Security) protocol. This typically uses a dedicated port 853, instead of 443 as in HTTPS. DoT, like DoH, encrypts DNS traffic to protect against eavesdropping and tampering attacks, but because it is not embedded within HTTPS traffic, it can be more easily distinguished and managed by network administrators.
When I want to secure DNS resolution for my self-hosted services, I generally prefer DoT, especially because it offers a stable and direct encryption layer. DoT provides a more transparent solution for network administrators who want to enforce and audit DNS policies, particularly in corporate environments.
DNSSEC (Domain Name System Security Extensions)
Unlike DoH and DoT, DNSSEC does not encrypt DNS queries; instead, it cryptographically authenticates the origin and integrity of DNS responses. This ensures that the information you receive from a DNS server truly comes from the authoritative server for that domain name and has not been altered in transit. DNSSEC primarily protects against DNS spoofing attacks.
In a production ERP system, enabling DNSSEC for the resolution of critical domain names for supply chain integrations was an important step for data integrity. However, DNSSEC itself does not provide query privacy; queries can still be transmitted unencrypted. Therefore, for both privacy and integrity, DNSSEC is often used in conjunction with DoH or DoT.
How to Evaluate the Performance Impact of Secure DNS?
Secure DNS technologies, by introducing an additional encryption and protocol layer, naturally incur a performance cost compared to traditional DNS. This cost manifests primarily in latency and sometimes in throughput. I have observed these effects numerous times in my own network infrastructures and client projects.
Latency
The TLS handshake process is the biggest source of latency for DoH and DoT. Before a DNS query can be sent, a TLS connection must be established between the client and the secure DNS server. This handshake can take anywhere from a few milliseconds to hundreds of milliseconds and is repeated for each new connection. If connection pooling or keep-alive mechanisms are not working correctly, every query can encounter this additional delay. For example, in DNS resolution for the backend of one of my mobile applications, I noticed a noticeable slowdown in initial queries after switching to DoT; this was due to the TLS handshake.
Furthermore, DoH operating over the HTTP layer also creates additional overhead. Although this overhead is minimized with HTTP/2 or HTTP/3 (QUIC), it still requires more processing power and network packets than traditional UDP-based DNS. For small, instantaneous queries, this additional latency can significantly affect the overall response time of the application.
Throughput and Resource Consumption
Encryption and decryption operations consume CPU resources on both the client and server sides. In a system with a high volume of DNS queries, this additional CPU load can reduce throughput. In my tests, especially on low-power devices or high-traffic DNS servers, I observed that using DoH/DoT increased CPU usage, reducing the number of queries that could be processed per second.
On the network side, encrypted packets are generally larger than unencrypted packets, which can mean more bandwidth consumption and potentially more fragmentation. For users in remote locations, this can further increase network latency.
Caching Optimizations
To balance the performance cost, a robust DNS caching strategy is vital. Caching, both on the client side (e.g., at the operating system or browser level) and at the network level (e.g., a local DNS resolver), allows repeated queries to bypass the TLS handshake and encryption overhead. A properly configured cache can significantly alleviate the latency burden imposed by secure DNS.
However, setting TTL (Time To Live) values too high for caching can cause changes in DNS records to be reflected late. This can create problems, especially in systems with dynamic IP addresses or frequently updated service records. Therefore, when determining a caching strategy, it is important to strike a good balance between latency reduction and the need for up-to-date data.
What are the Privacy and Security Gains?
The primary goal of Secure DNS technologies is to enhance privacy and security on the internet. These technologies eliminate the vulnerabilities introduced by the plain-text nature of traditional DNS, offering significant advantages to users. I have repeatedly seen the value of these gains in my own network security practices.
Prevention of Eavesdropping
The most prominent benefit of DoH and DoT is that by encrypting DNS queries and responses, they prevent third parties (ISPs, network administrators, malicious actors) from seeing which sites you visit or which services you connect to by eavesdropping on network traffic. This is a critical step for personal privacy. Especially in a side product I developed that handles sensitive data, encrypting the DNS traffic of backend services with DoT significantly reduced potential monitoring risks.
In traditional DNS, all your queries are clearly visible, and this information can be used for advertising, censorship, or targeted attacks. Encryption largely complicates such data collection and manipulation.
Reducing ISP Tracking
Many ISPs track their customers’ DNS queries to build detailed profiles of their internet usage habits. These profiles are often used for commercial purposes such as ad targeting or data selling. By using Secure DNS, your queries are sent encrypted to a secure DNS provider of your choice (e.g., Cloudflare, Google Public DNS) instead of to DNS servers controlled by your ISP. This significantly limits your ISP’s ability to track you.
However, a point to note here is the possibility that your secure DNS provider might also keep query logs and use this data. Therefore, choosing a trustworthy and privacy-focused provider is important.
Data Integrity and Authentication (DNSSEC)
While DNSSEC does not provide encryption, it adds a critical layer of security by guaranteeing the integrity and authenticity of DNS responses. In a DNSSEC-signed response, it is cryptographically proven that the response came from the authoritative DNS server and has not been altered in transit. This specifically protects against DNS spoofing attacks.
In a bank’s internal platform, validating the domain name resolution of critical services with DNSSEC provided an additional layer of protection against a potential impersonation attack. If an attacker attempts to manipulate a DNS response, DNSSEC validation fails, and the client is not directed to a wrong or fake IP address. This is an indispensable feature, especially in areas requiring high security like financial transactions.
Application Scenarios and My Preferences
When and where you use Secure DNS technologies depends on your needs and the trade-offs you face. In my own projects and in the organizations I consult for, I have adopted various approaches for different scenarios. There is no single “best” solution; there is always a search for balance.
Individual Use and Browser Integrations
As an individual user or if privacy is your priority at the browser level, DoH is generally the easiest and most effective solution. Modern browsers (Firefox, Chrome) support DoH by default, and its configuration is quite simple. This provides an additional layer of privacy, especially when browsing on public Wi-Fi networks or untrusted networks. On my own computer, I often keep DoH active at the browser level because it provides quick and easy protection.
However, browser-level DoH does not cover DNS queries from the operating system or other applications. For full system-wide protection, operating system-level DoT or DoH configuration may be necessary.
For Corporate Networks and Network Administrators
In corporate networks, the situation is more complex. Network administrators typically want to inspect, filter, and enforce specific security policies on DNS traffic. At this point, DoH’s “hiding” feature can become a disadvantage. Since DoH traffic is mixed with standard HTTPS traffic, it becomes harder to block access to malicious sites or perform content filtering.
In such environments, DoT is generally a more preferable option. Because DoT uses a separate port (853), it can be more easily distinguished and managed by network devices. Network administrators can direct DoT traffic to specific DNS servers, inspect it, and filter it according to company policies. In an ERP project for a manufacturing company, as part of our network segmentation strategy, I mandated that all critical service DNS queries within the internal network go through a central DoT resolver. This ensured both security and auditability.
Performance-Sensitive Systems
When high performance and low latency are critical, especially in places like game servers, financial transaction platforms, or real-time data streaming systems, the performance cost of Secure DNS must be evaluated very carefully. In such cases, it might be logical to use a local, high-performance, and well-cached DNS resolver to reduce the encryption load introduced by DoH/DoT while ensuring data integrity with DNSSEC.
In my experience, in some cases, I have opted for raw DNS speed by foregoing encryption within the local network, but maintained a strict security posture with ZTNA egress control and firewall policies at the network boundary. This is always a matter of balance and depends on your risk tolerance.
Conclusion
Secure DNS technologies are important steps we take for internet privacy and security. DoH and DoT encrypt DNS queries, making eavesdropping and manipulation more difficult, while DNSSEC guarantees the integrity and authenticity of responses. However, these gains come with a performance cost, especially in terms of latency and resource consumption.
In my experience, when implementing these technologies, it is necessary to thoroughly analyze the system requirements and use cases. While DoH/DoT provides a direct benefit for individual users and privacy-focused scenarios, in corporate networks, auditability and performance requirements may make DoT or hybrid approaches more attractive. In all cases, a robust caching strategy and careful configuration are essential to minimize performance costs. Remember, the trade-off between security and performance is always a balancing act that needs to be managed carefully.