{"id":2169,"date":"2026-08-12T08:00:00","date_gmt":"2026-08-12T07:00:00","guid":{"rendered":"https:\/\/ic-services.io\/?p=2169"},"modified":"2026-10-21T14:14:09","modified_gmt":"2026-10-21T13:14:09","slug":"dns-chiffre-doh-li-impact","status":"publish","type":"post","link":"https:\/\/ic-services.io\/fr\/resources\/blog\/encrypted-dns-doh-dot-li-impact\/","title":{"rendered":"DNS crypt\u00e9 (DoH\/DoT) et son impact sur les capacit\u00e9s d'interception l\u00e9gale"},"content":{"rendered":"

The Domain Name System (DNS) has long been one of the most valuable data sources for lawful interception and network intelligence. DNS queries reveal which websites a user visits, which services they access, and which applications they use, even when the rest of the traffic is encrypted. For decades, DNS traffic has been transmitted in plaintext, making it readily accessible to network-level interception. The emergence of encrypted DNS protocols \u2014 DNS over HTTPS (DoH) and DNS over TLS (DoT) \u2014 is fundamentally changing this landscape, with significant implications for capacit\u00e9s d'interception l\u00e9gales<\/a>.<\/p>\n\n\n\n

Cet article examine le fonctionnement des protocoles DoH et DoT, les raisons de leur adoption, leur incidence sur l'interception l\u00e9gale, ainsi que les mesures que les op\u00e9rateurs peuvent prendre pour continuer \u00e0 respecter leurs obligations de conformit\u00e9 dans un contexte o\u00f9 le trafic DNS est de plus en plus chiffr\u00e9.<\/p>\n\n\n\n

Le d\u00e9fi du DNS chiffr\u00e9 pour les op\u00e9rateurs<\/h2>\n\n\n\n

Traditional DNS resolution uses port 53 (mostly UDP, with TCP for larger responses), transmitting queries and responses in plaintext. Anyone with access to the network path between the user and the DNS resolver \u2014 including the operator, intermediate network elements, and potential eavesdroppers \u2014 can observe the DNS queries and determine which domain names the user is resolving.<\/p>\n\n\n\n

DNS over TLS (DoT), defined in RFC 7858, encrypts DNS traffic by wrapping it in a TLS connection on TCP port 853. The DNS queries and responses are encrypted in transit, preventing observation by intermediaries. However, the use of a dedicated port (853) makes DoT traffic identifiable at the network level \u2014 an observer can determine that DNS resolution is occurring, even though the content of the queries is encrypted. A third protocol, DNS over QUIC (DoQ, RFC 9250), runs on UDP port 853. Oblivious DoH (RFC 9230) additionally hides the user’s IP address from the resolver.<\/p>\n\n\n\n

DNS over HTTPS (DoH), defined in RFC 8484, takes encryption a step further by tunnelling DNS traffic within standard HTTPS connections on port 443 (TCP, or UDP when HTTP\/3 over QUIC is used). Because DoH uses ordinary HTTPS on port 443, its content cannot be separated from web traffic, although connections to well-known public resolvers can still be recognised by their addresses. DoH effectively hides DNS resolution within the vast volume of encrypted web traffic that traverses modern networks.<\/p>\n\n\n\n

Ces deux protocoles sont con\u00e7us pour prot\u00e9ger la vie priv\u00e9e des utilisateurs en emp\u00eachant les interm\u00e9diaires du r\u00e9seau d'observer les requ\u00eates DNS. Les principaux \u00e9diteurs de navigateurs \u2014 notamment Mozilla Firefox et Google Chrome \u2014 ont int\u00e9gr\u00e9 la prise en charge du DoH, et certains syst\u00e8mes d'exploitation prennent d\u00e9sormais en charge le DoH et le DoT de mani\u00e8re native. L'adoption du DNS chiffr\u00e9 s'acc\u00e9l\u00e8re, sous l'impulsion des d\u00e9fenseurs de la vie priv\u00e9e, des param\u00e8tres par d\u00e9faut des navigateurs et de la tendance g\u00e9n\u00e9rale au chiffrement de l'ensemble du trafic r\u00e9seau.<\/p>\n\n\n\n

L'impact sur l'interception l\u00e9gale<\/h2>\n\n\n\n

The encryption of DNS traffic has a direct and significant impact on lawful interception capabilities. Plaintext DNS queries have traditionally been visible to investigators inside the content of communication (CC): the IP copy of the target’s traffic includes every DNS packet, providing a detailed record of the target’s online activity. When a target visits a website, sends an email, or uses an application, the corresponding DNS queries reveal the domain names involved, even when the content of the communication is encrypted.<\/p>\n\n\n\n

Avec les protocoles DoH et DoT, les op\u00e9rateurs ne peuvent plus surveiller les requ\u00eates DNS au niveau du r\u00e9seau si l'appareil cible est configur\u00e9 pour utiliser un r\u00e9solveur DNS chiffr\u00e9 qui n'est pas g\u00e9r\u00e9 par l'op\u00e9rateur. Le processus de r\u00e9solution DNS est chiffr\u00e9 de bout en bout entre l'appareil et le r\u00e9solveur, et les \u00e9quipements r\u00e9seau de l'op\u00e9rateur ne peuvent pas d\u00e9chiffrer les requ\u00eates sans avoir acc\u00e8s aux cl\u00e9s de session TLS.<\/p>\n\n\n\n

This loss of DNS visibility affects real-time interception: the IP copy of the target’s traffic still contains every DNS packet, but with DoH and DoT those packets are encrypted, so the LEA loses the domain names it used to read from them. Encrypted DNS does not affect retained data: data retention rules, where they apply, cover subscriber and IP-assignment records. They do not cover DNS queries or browsing history, which in Germany are expressly excluded from data retention (\u00a7 176(5) TKG).<\/p>\n\n\n\n

L'impact est particuli\u00e8rement important lorsque la cible utilise un r\u00e9solveur DoH tiers \u2014 tel que ceux exploit\u00e9s par Cloudflare, Google ou d'autres fournisseurs \u2014 plut\u00f4t que l'infrastructure DNS propre \u00e0 l'op\u00e9rateur. Dans ce cas, les requ\u00eates DNS sont r\u00e9solues enti\u00e8rement en dehors du r\u00e9seau de l\u2019op\u00e9rateur, et celui-ci n\u2019y a absolument aucun acc\u00e8s. Si la cible utilise le r\u00e9solveur DNS de l\u2019op\u00e9rateur lui-m\u00eame avec DoT ou DoH, l\u2019op\u00e9rateur conserve l\u2019acc\u00e8s aux donn\u00e9es de requ\u00eate au niveau du r\u00e9solveur, mais pas aux points interm\u00e9diaires du r\u00e9seau.<\/p>\n\n\n\n

Strat\u00e9gies d'att\u00e9nuation \u00e0 l'intention des exploitants<\/h2>\n\n\n\n

Operators cannot prevent the adoption of encrypted DNS, but they can implement strategies to mitigate its impact on lawful interception. The first strategy is to operate their own DoH and DoT resolvers and to encourage their subscribers to use these resolvers, for example by advertising them through DDR (RFC 9462) or DNR (RFC 9463) so that devices upgrade to the operator’s encrypted resolver automatically. If the operator runs the encrypted resolver, an interception point at the resolver can still see a target’s queries in plaintext once a valid order is in force. This is not a reason to log all subscribers’ DNS: keeping such data needs its own legal basis. This approach preserves DNS visibility for lawful interception while still providing subscribers with the privacy benefits of encrypted DNS against third-party observation.<\/p>\n\n\n\n

The second strategy involves using alternative data sources to reconstruct the information that DNS queries previously provided. Server Name Indication (SNI) in TLS handshakes provides the domain name of the server that the client is connecting to, and this information has traditionally been transmitted in plaintext. However, Encrypted Client Hello (ECH, RFC 9849, published 2026, the successor to ESNI) now encrypts the SNI as well, wherever browser and server support it, further reducing visibility. IP address analysis can also provide some information about which services a target is accessing, but the widespread use of content delivery networks (CDNs) and shared hosting means that IP-to-domain mapping is often ambiguous.<\/p>\n\n\n\n

The third strategy is to implement interception at the application layer or at the device level, rather than relying solely on network-level data. This approach is beyond the scope of traditional telecommunications interception, but some jurisdictions already permit device-level interception under strict conditions (in Germany, ‘Quellen-TK\u00dc’ under \u00a7 100a StPO), as a response to the increasing encryption of network traffic. For operators, this is not a practical solution, but it is part of the broader context in which encrypted DNS should be understood.<\/p>\n\n\n\n

A fourth strategy involves regulatory and policy engagement. Outside the EU, some governments block third-party resolvers or encrypted handshakes. In the EU, net-neutrality rules (Regulation (EU) 2015\/2120) make such blocking by operators difficult without a specific legal basis. These approaches are controversial and raise questions about network neutrality, user freedom, and technical feasibility.<\/p>\n\n\n\n

La tendance g\u00e9n\u00e9rale au chiffrement<\/h2>\n\n\n\n

Le DNS chiffr\u00e9 s'inscrit dans une tendance plus large au chiffrement de l'ensemble du trafic r\u00e9seau, motiv\u00e9e par des pr\u00e9occupations en mati\u00e8re de confidentialit\u00e9, les bonnes pratiques de s\u00e9curit\u00e9 et les configurations par d\u00e9faut des principales plateformes logicielles. TLS 1.3, ECH, QUIC et d\u2019autres technologies chiffrent progressivement une part croissante des m\u00e9tadonn\u00e9es et du contenu sur lesquels reposaient traditionnellement les interceptions au niveau du r\u00e9seau. Chaque \u00e9tape de cette \u00e9volution vers le chiffrement r\u00e9duit la visibilit\u00e9 dont disposent les op\u00e9rateurs et, par extension, celle dont b\u00e9n\u00e9ficient les interceptions l\u00e9gales.<\/p>\n\n\n\n

Les op\u00e9rateurs doivent prendre conscience que la visibilit\u00e9 dont ils ont toujours b\u00e9n\u00e9fici\u00e9 au niveau du r\u00e9seau est en train de diminuer et continuera de diminuer. La r\u00e9ponse \u00e0 cette tendance ne peut pas \u00eatre purement technique : elle n\u00e9cessite une collaboration avec les r\u00e9gulateurs, les organismes de normalisation et les forces de l'ordre afin de d\u00e9velopper de nouvelles approches en mati\u00e8re d'interception l\u00e9gale qui tiennent compte des r\u00e9alit\u00e9s d'un environnement r\u00e9seau fortement chiffr\u00e9.<\/p>\n\n\n\n

At the same time, operators must continue to deliver whatever interception data they are technically capable of providing. The encryption of DNS does not eliminate the operator’s legal obligation to intercept; it changes the scope of what can be intercepted. Operators must remove encryption they apply in the network or whose keys they help generate or exchange (in Germany \u00a7 8(3) TK\u00dcV). Third-party DoH or DoT traffic is handed over as captured. Operators must be transparent with law enforcement about these limitations and must ensure that their LI systems are updated to handle the reduced visibility gracefully \u2014 delivering the complete copy of the target\u2019s traffic, encrypted DNS included, without filtering it.<\/p>\n\n\n\n

Cons\u00e9quences en mati\u00e8re de conformit\u00e9 et de reporting<\/h2>\n\n\n\n

Encrypted DNS does not reduce what an operator has to deliver: the complete copy of the target\u2019s traffic, including the encrypted DNS packets, still meets the obligation. What changes is what law enforcement can read from it, and operators should explain this when agencies ask why domain names are missing.<\/p>\n\n\n\n

Dans certaines juridictions, les autorit\u00e9s de r\u00e9gulation pourraient devoir actualiser leurs exigences et attentes techniques afin de tenir compte de la r\u00e9alit\u00e9 du DNS chiffr\u00e9. Les op\u00e9rateurs peuvent jouer un r\u00f4le constructif dans ce processus en apportant leur expertise technique et leurs connaissances pratiques pour \u00e9clairer l'\u00e9laboration de la r\u00e9glementation. Le pire sc\u00e9nario pour toutes les parties serait que les autorit\u00e9s de r\u00e9gulation exigent des op\u00e9rateurs qu'ils fournissent des donn\u00e9es auxquelles ils n'ont techniquement pas acc\u00e8s \u2014 une situation qui engendre un risque de non-conformit\u00e9 sans apporter de valeur ajout\u00e9e aux enqu\u00eates.<\/p>\n\n\n\n

Conclusion<\/h2>\n\n\n\n

Encrypted DNS represents a significant shift in the balance between privacy and surveillance capability in telecommunications networks. DoH and DoT protect user privacy by preventing the observation of DNS queries by network intermediaries, but they also reduce the visibility available to lawful interception systems. Operators can help by offering their own encrypted DNS resolvers, leveraging alternative data sources, engaging with regulators on evolving requirements, and ensuring that their LI systems accurately reflect the data that is actually available. The trend toward comprehensive network encryption is irreversible, and operators that adapt proactively will be better positioned to maintain compliance and to provide meaningful support to law enforcement within the constraints of the evolving technical landscape.<\/p>\n\n\n

Le d\u00e9bat autour du DNS chiffr\u00e9 met \u00e9galement en \u00e9vidence la tension entre les droits \u00e0 la vie priv\u00e9e des individus et les besoins l\u00e9gitimes des forces de l\u2019ordre. Trouver le juste \u00e9quilibre n\u00e9cessite une collaboration entre les experts en technologie, les d\u00e9cideurs politiques, la soci\u00e9t\u00e9 civile et les forces de l\u2019ordre. Les op\u00e9rateurs se trouvent au carrefour de ces int\u00e9r\u00eats et ont la responsabilit\u00e9 particuli\u00e8re de veiller \u00e0 ce que les capacit\u00e9s techniques, les obligations l\u00e9gales et les mesures de protection de la vie priv\u00e9e soient harmonis\u00e9es. En participant activement \u00e0 l'\u00e9laboration des normes, aux consultations r\u00e9glementaires et aux forums sectoriels, les op\u00e9rateurs peuvent contribuer \u00e0 d\u00e9finir des solutions qui respectent la vie priv\u00e9e tout en pr\u00e9servant la capacit\u00e9 des soci\u00e9t\u00e9s d\u00e9mocratiques \u00e0 mener une surveillance l\u00e9gale, conform\u00e9ment \u00e0 l'\u00c9tat de droit.<\/p>\n\n\n\n

Articles connexes<\/h2>\n\n\n\n

Pour en savoir plus sur des sujets connexes, consultez les articles suivants :<\/p>\n\n\n\n