{"id":2169,"date":"2026-08-12T08:00:00","date_gmt":"2026-08-12T07:00:00","guid":{"rendered":"https:\/\/ic-services.io\/?p=2169"},"modified":"2026-10-21T14:14:09","modified_gmt":"2026-10-21T13:14:09","slug":"impacto-del-dns-cifrado-doh-li","status":"publish","type":"post","link":"https:\/\/ic-services.io\/es\/resources\/blog\/encrypted-dns-doh-dot-li-impact\/","title":{"rendered":"DNS cifrado (DoH\/DoT) y su impacto en las capacidades de interceptaci\u00f3n legal"},"content":{"rendered":"

The Domain Name System (DNS) has long been one of the most valuable data sources for lawful interception and network intelligence. DNS queries reveal which websites a user visits, which services they access, and which applications they use, even when the rest of the traffic is encrypted. For decades, DNS traffic has been transmitted in plaintext, making it readily accessible to network-level interception. The emergence of encrypted DNS protocols \u2014 DNS over HTTPS (DoH) and DNS over TLS (DoT) \u2014 is fundamentally changing this landscape, with significant implications for capacidades de interceptaci\u00f3n l\u00edcita<\/a>.<\/p>\n\n\n\n

Este art\u00edculo analiza c\u00f3mo funcionan el DoH y el DoT, por qu\u00e9 se est\u00e1n adoptando, c\u00f3mo afectan a la interceptaci\u00f3n legal y qu\u00e9 pueden hacer los operadores para cumplir con sus obligaciones de cumplimiento normativo en un entorno en el que el tr\u00e1fico DNS est\u00e1 cada vez m\u00e1s cifrado.<\/p>\n\n\n\n

El reto del DNS cifrado para los operadores<\/h2>\n\n\n\n

Traditional DNS resolution uses port 53 (mostly UDP, with TCP for larger responses), transmitting queries and responses in plaintext. Anyone with access to the network path between the user and the DNS resolver \u2014 including the operator, intermediate network elements, and potential eavesdroppers \u2014 can observe the DNS queries and determine which domain names the user is resolving.<\/p>\n\n\n\n

DNS over TLS (DoT), defined in RFC 7858, encrypts DNS traffic by wrapping it in a TLS connection on TCP port 853. The DNS queries and responses are encrypted in transit, preventing observation by intermediaries. However, the use of a dedicated port (853) makes DoT traffic identifiable at the network level \u2014 an observer can determine that DNS resolution is occurring, even though the content of the queries is encrypted. A third protocol, DNS over QUIC (DoQ, RFC 9250), runs on UDP port 853. Oblivious DoH (RFC 9230) additionally hides the user’s IP address from the resolver.<\/p>\n\n\n\n

DNS over HTTPS (DoH), defined in RFC 8484, takes encryption a step further by tunnelling DNS traffic within standard HTTPS connections on port 443 (TCP, or UDP when HTTP\/3 over QUIC is used). Because DoH uses ordinary HTTPS on port 443, its content cannot be separated from web traffic, although connections to well-known public resolvers can still be recognised by their addresses. DoH effectively hides DNS resolution within the vast volume of encrypted web traffic that traverses modern networks.<\/p>\n\n\n\n

Ambos protocolos est\u00e1n dise\u00f1ados para proteger la privacidad de los usuarios al impedir que los intermediarios de red puedan observar las consultas DNS. Los principales fabricantes de navegadores \u2014entre ellos, Mozilla Firefox y Google Chrome\u2014 han implementado la compatibilidad con DoH, y algunos sistemas operativos ya admiten DoH y DoT de forma nativa. La adopci\u00f3n del DNS cifrado se est\u00e1 acelerando, impulsada por la defensa de la privacidad, la configuraci\u00f3n predeterminada de los navegadores y la tendencia generalizada hacia el cifrado de todo el tr\u00e1fico de red.<\/p>\n\n\n\n

El impacto en la interceptaci\u00f3n legal<\/h2>\n\n\n\n

The encryption of DNS traffic has a direct and significant impact on lawful interception capabilities. Plaintext DNS queries have traditionally been visible to investigators inside the content of communication (CC): the IP copy of the target’s traffic includes every DNS packet, providing a detailed record of the target’s online activity. When a target visits a website, sends an email, or uses an application, the corresponding DNS queries reveal the domain names involved, even when the content of the communication is encrypted.<\/p>\n\n\n\n

Con DoH y DoT, los operadores ya no pueden observar las consultas DNS a nivel de red si el dispositivo del destinatario est\u00e1 configurado para utilizar un resolutor DNS cifrado que no sea gestionado por el operador. El proceso de resoluci\u00f3n de DNS est\u00e1 cifrado de extremo a extremo entre el dispositivo y el resolutor, y los equipos de red del operador no pueden descifrar las consultas sin tener acceso a las claves de sesi\u00f3n TLS.<\/p>\n\n\n\n

This loss of DNS visibility affects real-time interception: the IP copy of the target’s traffic still contains every DNS packet, but with DoH and DoT those packets are encrypted, so the LEA loses the domain names it used to read from them. Encrypted DNS does not affect retained data: data retention rules, where they apply, cover subscriber and IP-assignment records. They do not cover DNS queries or browsing history, which in Germany are expressly excluded from data retention (\u00a7 176(5) TKG).<\/p>\n\n\n\n

El impacto es m\u00e1s grave cuando el destinatario utiliza un resolutor DoH de terceros \u2014como los que gestionan Cloudflare, Google u otros proveedores\u2014 en lugar de la propia infraestructura DNS del operador. En este caso, las consultas DNS se resuelven \u00edntegramente fuera de la red del operador, y este no tiene acceso alguno a ellas. Si el destinatario utiliza el propio resolutor DNS del operador con DoT o DoH, el operador conserva el acceso a los datos de las consultas a nivel del resolutor, pero no en los puntos intermedios de la red.<\/p>\n\n\n\n

Estrategias de mitigaci\u00f3n para los operadores<\/h2>\n\n\n\n

Operators cannot prevent the adoption of encrypted DNS, but they can implement strategies to mitigate its impact on lawful interception. The first strategy is to operate their own DoH and DoT resolvers and to encourage their subscribers to use these resolvers, for example by advertising them through DDR (RFC 9462) or DNR (RFC 9463) so that devices upgrade to the operator’s encrypted resolver automatically. If the operator runs the encrypted resolver, an interception point at the resolver can still see a target’s queries in plaintext once a valid order is in force. This is not a reason to log all subscribers’ DNS: keeping such data needs its own legal basis. This approach preserves DNS visibility for lawful interception while still providing subscribers with the privacy benefits of encrypted DNS against third-party observation.<\/p>\n\n\n\n

The second strategy involves using alternative data sources to reconstruct the information that DNS queries previously provided. Server Name Indication (SNI) in TLS handshakes provides the domain name of the server that the client is connecting to, and this information has traditionally been transmitted in plaintext. However, Encrypted Client Hello (ECH, RFC 9849, published 2026, the successor to ESNI) now encrypts the SNI as well, wherever browser and server support it, further reducing visibility. IP address analysis can also provide some information about which services a target is accessing, but the widespread use of content delivery networks (CDNs) and shared hosting means that IP-to-domain mapping is often ambiguous.<\/p>\n\n\n\n

The third strategy is to implement interception at the application layer or at the device level, rather than relying solely on network-level data. This approach is beyond the scope of traditional telecommunications interception, but some jurisdictions already permit device-level interception under strict conditions (in Germany, ‘Quellen-TK\u00dc’ under \u00a7 100a StPO), as a response to the increasing encryption of network traffic. For operators, this is not a practical solution, but it is part of the broader context in which encrypted DNS should be understood.<\/p>\n\n\n\n

A fourth strategy involves regulatory and policy engagement. Outside the EU, some governments block third-party resolvers or encrypted handshakes. In the EU, net-neutrality rules (Regulation (EU) 2015\/2120) make such blocking by operators difficult without a specific legal basis. These approaches are controversial and raise questions about network neutrality, user freedom, and technical feasibility.<\/p>\n\n\n\n

La tendencia general hacia el cifrado<\/h2>\n\n\n\n

El DNS cifrado forma parte de una tendencia m\u00e1s amplia hacia el cifrado de todo el tr\u00e1fico de red, impulsada por cuestiones de privacidad, las mejores pr\u00e1cticas de seguridad y las configuraciones predeterminadas de las principales plataformas de software. TLS 1.3, ECH, QUIC y otras tecnolog\u00edas est\u00e1n cifrando progresivamente una mayor parte de los metadatos y el contenido en los que tradicionalmente se ha basado la interceptaci\u00f3n a nivel de red. Cada paso en esta tendencia hacia el cifrado reduce la visibilidad de que disponen los operadores y, por extensi\u00f3n, la de la interceptaci\u00f3n legal.<\/p>\n\n\n\n

Los operadores deben reconocer que la visibilidad a nivel de red de la que han disfrutado hist\u00f3ricamente est\u00e1 disminuyendo y seguir\u00e1 disminuyendo. La respuesta a esta tendencia no puede ser meramente t\u00e9cnica: requiere la colaboraci\u00f3n con los organismos reguladores, los organismos de normalizaci\u00f3n y las fuerzas del orden para desarrollar nuevos enfoques de interceptaci\u00f3n l\u00edcita que tengan en cuenta las realidades de un entorno de red fuertemente cifrado.<\/p>\n\n\n\n

At the same time, operators must continue to deliver whatever interception data they are technically capable of providing. The encryption of DNS does not eliminate the operator’s legal obligation to intercept; it changes the scope of what can be intercepted. Operators must remove encryption they apply in the network or whose keys they help generate or exchange (in Germany \u00a7 8(3) TK\u00dcV). Third-party DoH or DoT traffic is handed over as captured. Operators must be transparent with law enforcement about these limitations and must ensure that their LI systems are updated to handle the reduced visibility gracefully \u2014 delivering the complete copy of the target\u2019s traffic, encrypted DNS included, without filtering it.<\/p>\n\n\n\n

Repercusiones en materia de cumplimiento normativo y presentaci\u00f3n de informes<\/h2>\n\n\n\n

Encrypted DNS does not reduce what an operator has to deliver: the complete copy of the target\u2019s traffic, including the encrypted DNS packets, still meets the obligation. What changes is what law enforcement can read from it, and operators should explain this when agencies ask why domain names are missing.<\/p>\n\n\n\n

Es posible que los organismos reguladores de algunas jurisdicciones tengan que actualizar sus requisitos t\u00e9cnicos y expectativas para tener en cuenta la realidad del DNS cifrado. Los operadores pueden desempe\u00f1ar un papel constructivo en este proceso aportando sus conocimientos t\u00e9cnicos y su experiencia pr\u00e1ctica para orientar el desarrollo de la normativa. El peor resultado para todas las partes ser\u00eda que la normativa exigiera a los operadores que facilitaran datos a los que no pueden acceder t\u00e9cnicamente, una situaci\u00f3n que generar\u00eda un riesgo de incumplimiento normativo sin aportar ning\u00fan valor a la investigaci\u00f3n.<\/p>\n\n\n\n

Conclusi\u00f3n<\/h2>\n\n\n\n

Encrypted DNS represents a significant shift in the balance between privacy and surveillance capability in telecommunications networks. DoH and DoT protect user privacy by preventing the observation of DNS queries by network intermediaries, but they also reduce the visibility available to lawful interception systems. Operators can help by offering their own encrypted DNS resolvers, leveraging alternative data sources, engaging with regulators on evolving requirements, and ensuring that their LI systems accurately reflect the data that is actually available. The trend toward comprehensive network encryption is irreversible, and operators that adapt proactively will be better positioned to maintain compliance and to provide meaningful support to law enforcement within the constraints of the evolving technical landscape.<\/p>\n\n\n

El debate en torno al DNS cifrado tambi\u00e9n pone de relieve la tensi\u00f3n existente entre los derechos de privacidad de las personas y las necesidades leg\u00edtimas de las fuerzas del orden. Encontrar el equilibrio adecuado requiere la colaboraci\u00f3n entre los expertos en tecnolog\u00eda, los responsables pol\u00edticos, la sociedad civil y las fuerzas del orden. Los operadores se encuentran en la encrucijada de estos intereses y tienen la responsabilidad \u00fanica de garantizar que las capacidades t\u00e9cnicas, las obligaciones legales y las medidas de protecci\u00f3n de la privacidad est\u00e9n en consonancia. Al participar activamente en el desarrollo de normas, en las consultas regulatorias y en los foros del sector, los operadores pueden contribuir a dar forma a soluciones que respeten la privacidad y, al mismo tiempo, preserven la capacidad de las sociedades democr\u00e1ticas para llevar a cabo una vigilancia l\u00edcita de conformidad con el Estado de derecho.<\/p>\n\n\n\n

Art\u00edculos relacionados<\/h2>\n\n\n\n

Si desea leer m\u00e1s sobre temas relacionados, consulte estos art\u00edculos:<\/p>\n\n\n\n