Secrets Best Not Shared: DNS Privacy Enhancements for the Constrained IoT

2026-06-08

AI Summary

This study addresses the vulnerability of resource-constrained IoT devices to identification and privacy leakage in conventional DNS communications, which also exposes them to service disruption attacks. The work presents the first systematic evaluation of the privacy-preserving potential of DNS over CoAP and introduces a traffic obfuscation strategy integrating fixed-length packetization, block-wise transfer, and header-payload compression. To further enhance anonymity, the approach incorporates a variant of onion routing. Experimental results demonstrate that, across diverse link conditions, the proposed method reduces DNS frame identification accuracy to 77%, substantially outperforming DNS over HTTPS, which remains trivially identifiable via IP addresses. The authors also release a public dataset to establish a benchmark for future research in this domain.

Abstract

Attackers often identify DNS traffic to disrupt or compromise Internet services. While prior work has focused on encrypting queries using DNS over TLS, HTTPS, or QUIC to counter such attacks, we consider IETF protocols designed for resource-constrained IoT devices and empirically analyze the potential of obfuscating DNS traffic in addition to encryption. We create a dataset of machine-to-machine-compatible data objects along with the corresponding DNS resolution processes, evaluating 296 deployment scenarios of resolving host names, including DNS over the Constrained Application Layer Protocol (CoAP) and an onion routing flavor of CoAP under varying link-layer conditions. We compare them to DNS over HTTPS. Using Random Forest and a header field analysis, we identify fields that leak most information. Our findings show that DNS over CoAP with equalized packet lengths, block-wise transfer, and header compression reduces the accuracy of identifying DNS frames to 86% and further to 77% with payload compression. Our approach outperforms DNS over HTTPS, where classifiers always identify DNS frames based on IP addresses. The dataset is publicly available.

Problem

• DNS privacy
• IoT
• traffic obfuscation
• constrained devices
• DNS identification

Innovation

• DNS privacy
• CoAP
• traffic obfuscation
• constrained IoT
• header compression