DNS Resolver Probing to Block Unauthorized Encrypted DNS

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional DNS systems face issues with visibility, privacy, and security, allowing for data exfiltration, exposure to malware, and inability to effectively block unauthorized DNS resolvers, especially with encrypted protocols like DoH.

Innovation Solution

A DNS Protection agent identifies unknown DNS resolvers by probing destinations with DNS requests and maintaining a list of unauthorized resolvers, blocking connections to them, and using trusted DNS servers for secure DNS protocols.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If standard DNS requests are blocked on port 53, then unauthorized DNS resolvers can be blocked, but legitimate DNS traffic is also blocked

Engineering Contradiction:

ImproveDNS resolution reliabilityVSAvoidunauthorized DNS resolver access

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments DNS traffic into different protocols (standard DNS on port 53 and DoH on port 443) and applies different blocking strategies to each. Standard DNS requests to unauthorized resolvers are blocked on port 53, while DoH traffic is handled separately through probing and identification mechanisms, allowing selective blocking without disrupting legitimate traffic.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary probing mechanism that sends test DNS requests to potential DoH resolvers to determine if they are actually DNS resolvers. This intermediary step allows the system to identify unauthorized resolvers before blocking traffic, using the probing result as a mediator between detection and blocking actions.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If DoH requests are blocked on port 443, then encrypted DNS resolvers can be blocked, but legitimate HTTPS traffic is also blocked

Engineering Contradiction:

Improveencrypted DNS resolver accessVSAvoidHTTPS traffic throughput

Core Design Contradiction:

Object-affected harmful factorsVSProductivity

Solution Approach 1:

The patent performs preliminary probing actions before blocking DoH traffic. Instead of immediately blocking all port 443 traffic, the system first sends test DNS requests to identify which destinations are actually DNS resolvers. Only after this preliminary identification does the system block traffic to confirmed unauthorized resolvers, avoiding disruption to legitimate HTTPS traffic.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements feedback through DNS probe requests that test whether a destination responds with DNS responses. The results of these probes feed back into the blocking decision, allowing the system to dynamically identify and block only those destinations that are confirmed DNS resolvers, rather than blocking all port 443 traffic indiscriminately.

Inventive Principle:

Principle #23Feedback

3Loss of information

If DNS visibility is increased to track users and devices, then network monitoring capability is improved, but user privacy is reduced

Engineering Contradiction:

ImproveDNS request visibilityVSAvoiduser exposure

Core Design Contradiction:

Loss of informationVSObject-affected harmful factors

Solution Approach 1:

The patent uses disposable probe requests that are sent temporarily to identify DNS resolvers. These probe requests are short-lived and do not持续 monitor user traffic, instead performing one-time identification actions. This allows the system to gain visibility into DNS resolver usage patterns without continuously exposing user privacy information.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

4Object-affected harmful factors

If all DNS resolvers are blocked, then unauthorized resolvers are prevented, but legitimate DNS resolution fails

Engineering Contradiction:

Improveunauthorized resolver usageVSAvoidDNS resolution functionality

Core Design Contradiction:

Object-affected harmful factorsVSReliability

Solution Approach 1:

The patent applies local quality by treating different DNS resolvers differently based on their identification status. Authorized resolvers continue to serve DNS requests normally, while unauthorized resolvers are blocked. The system maintains a list of identified unauthorized resolvers and applies selective blocking only to those specific destinations, preserving DNS functionality for legitimate providers.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS20260025356A1Systems and methods for identifying DNS resolvers

Publication Date: 2026.01.22 OPEN TEXT CORPORATION

AI summary

Embodiments provide systems and methods for identifying domain name service (DNS) resolvers. A computer-implemented method includes detecting a request from a client device to a destination. The method further includes sending a DNS request from the client device to the destination, receiving, at the client device, a DNS response from the destination, identifying the destination as a DNS resolver based on receiving the DNS response, and based on identifying the destination as a DNS resolver, blocking, at the client device, connections to the destination.