{"id":2169,"date":"2026-08-12T08:00:00","date_gmt":"2026-08-12T07:00:00","guid":{"rendered":"https:\/\/ic-services.io\/?p=2169"},"modified":"2026-10-21T14:14:09","modified_gmt":"2026-10-21T13:14:09","slug":"impacto-do-dns-encriptado-doh-li","status":"publish","type":"post","link":"https:\/\/ic-services.io\/pt\/resources\/blog\/encrypted-dns-doh-dot-li-impact\/","title":{"rendered":"DNS encriptado (DoH\/DoT) e o seu impacto nas capacidades de interce\u00e7\u00e3o legal"},"content":{"rendered":"

The Domain Name System (DNS) has long been one of the most valuable data sources for lawful interception and network intelligence. DNS queries reveal which websites a user visits, which services they access, and which applications they use, even when the rest of the traffic is encrypted. For decades, DNS traffic has been transmitted in plaintext, making it readily accessible to network-level interception. The emergence of encrypted DNS protocols \u2014 DNS over HTTPS (DoH) and DNS over TLS (DoT) \u2014 is fundamentally changing this landscape, with significant implications for capacidades de interce\u00e7\u00e3o legal<\/a>.<\/p>\n\n\n\n

Este artigo analisa o funcionamento do DoH e do DoT, as raz\u00f5es pelas quais est\u00e3o a ser adotados, o impacto que t\u00eam na interce\u00e7\u00e3o legal e o que as operadoras podem fazer para cumprir as suas obriga\u00e7\u00f5es de conformidade num ambiente em que o tr\u00e1fego DNS est\u00e1 cada vez mais encriptado.<\/p>\n\n\n\n

O Desafio do DNS Encriptado para os Operadores<\/h2>\n\n\n\n

Traditional DNS resolution uses port 53 (mostly UDP, with TCP for larger responses), transmitting queries and responses in plaintext. Anyone with access to the network path between the user and the DNS resolver \u2014 including the operator, intermediate network elements, and potential eavesdroppers \u2014 can observe the DNS queries and determine which domain names the user is resolving.<\/p>\n\n\n\n

DNS over TLS (DoT), defined in RFC 7858, encrypts DNS traffic by wrapping it in a TLS connection on TCP port 853. The DNS queries and responses are encrypted in transit, preventing observation by intermediaries. However, the use of a dedicated port (853) makes DoT traffic identifiable at the network level \u2014 an observer can determine that DNS resolution is occurring, even though the content of the queries is encrypted. A third protocol, DNS over QUIC (DoQ, RFC 9250), runs on UDP port 853. Oblivious DoH (RFC 9230) additionally hides the user’s IP address from the resolver.<\/p>\n\n\n\n

DNS over HTTPS (DoH), defined in RFC 8484, takes encryption a step further by tunnelling DNS traffic within standard HTTPS connections on port 443 (TCP, or UDP when HTTP\/3 over QUIC is used). Because DoH uses ordinary HTTPS on port 443, its content cannot be separated from web traffic, although connections to well-known public resolvers can still be recognised by their addresses. DoH effectively hides DNS resolution within the vast volume of encrypted web traffic that traverses modern networks.<\/p>\n\n\n\n

Ambos os protocolos foram concebidos para proteger a privacidade dos utilizadores, impedindo que os intermedi\u00e1rios de rede observem as consultas DNS. Os principais fornecedores de navegadores \u2014 incluindo o Mozilla Firefox e o Google Chrome \u2014 implementaram o suporte ao DoH, e alguns sistemas operativos j\u00e1 suportam o DoH e o DoT de forma nativa. A ado\u00e7\u00e3o do DNS encriptado est\u00e1 a acelerar, impulsionada pela defesa da privacidade, pelas predefini\u00e7\u00f5es dos navegadores e pela tend\u00eancia mais ampla para encriptar todo o tr\u00e1fego de rede.<\/p>\n\n\n\n

O impacto na intercep\u00e7\u00e3o legal<\/h2>\n\n\n\n

The encryption of DNS traffic has a direct and significant impact on lawful interception capabilities. Plaintext DNS queries have traditionally been visible to investigators inside the content of communication (CC): the IP copy of the target’s traffic includes every DNS packet, providing a detailed record of the target’s online activity. When a target visits a website, sends an email, or uses an application, the corresponding DNS queries reveal the domain names involved, even when the content of the communication is encrypted.<\/p>\n\n\n\n

Com o DoH e o DoT, os operadores j\u00e1 n\u00e3o conseguem monitorizar as consultas DNS ao n\u00edvel da rede se o dispositivo do destinat\u00e1rio estiver configurado para utilizar um resolvedor DNS encriptado que n\u00e3o seja gerido pelo operador. O processo de resolu\u00e7\u00e3o DNS \u00e9 encriptado de ponta a ponta entre o dispositivo e o resolvedor, e o equipamento de rede da operadora n\u00e3o consegue desencriptar as consultas sem acesso \u00e0s chaves de sess\u00e3o TLS.<\/p>\n\n\n\n

This loss of DNS visibility affects real-time interception: the IP copy of the target’s traffic still contains every DNS packet, but with DoH and DoT those packets are encrypted, so the LEA loses the domain names it used to read from them. Encrypted DNS does not affect retained data: data retention rules, where they apply, cover subscriber and IP-assignment records. They do not cover DNS queries or browsing history, which in Germany are expressly excluded from data retention (\u00a7 176(5) TKG).<\/p>\n\n\n\n

O impacto \u00e9 mais acentuado quando o alvo utiliza um resolvedor DoH de terceiros \u2014 como os operados pela Cloudflare, pelo Google ou por outros fornecedores \u2014 em vez da pr\u00f3pria infraestrutura DNS do operador. Neste caso, as consultas DNS s\u00e3o resolvidas inteiramente fora da rede da operadora, e esta n\u00e3o tem qualquer acesso \u00e0s mesmas. Se o destino utilizar o pr\u00f3prio resolvedor DNS da operadora com DoT ou DoH, a operadora mant\u00e9m o acesso aos dados das consultas ao n\u00edvel do resolvedor, mas n\u00e3o em pontos interm\u00e9dios da rede.<\/p>\n\n\n\n

Estrat\u00e9gias de mitiga\u00e7\u00e3o para os operadores<\/h2>\n\n\n\n

Operators cannot prevent the adoption of encrypted DNS, but they can implement strategies to mitigate its impact on lawful interception. The first strategy is to operate their own DoH and DoT resolvers and to encourage their subscribers to use these resolvers, for example by advertising them through DDR (RFC 9462) or DNR (RFC 9463) so that devices upgrade to the operator’s encrypted resolver automatically. If the operator runs the encrypted resolver, an interception point at the resolver can still see a target’s queries in plaintext once a valid order is in force. This is not a reason to log all subscribers’ DNS: keeping such data needs its own legal basis. This approach preserves DNS visibility for lawful interception while still providing subscribers with the privacy benefits of encrypted DNS against third-party observation.<\/p>\n\n\n\n

The second strategy involves using alternative data sources to reconstruct the information that DNS queries previously provided. Server Name Indication (SNI) in TLS handshakes provides the domain name of the server that the client is connecting to, and this information has traditionally been transmitted in plaintext. However, Encrypted Client Hello (ECH, RFC 9849, published 2026, the successor to ESNI) now encrypts the SNI as well, wherever browser and server support it, further reducing visibility. IP address analysis can also provide some information about which services a target is accessing, but the widespread use of content delivery networks (CDNs) and shared hosting means that IP-to-domain mapping is often ambiguous.<\/p>\n\n\n\n

The third strategy is to implement interception at the application layer or at the device level, rather than relying solely on network-level data. This approach is beyond the scope of traditional telecommunications interception, but some jurisdictions already permit device-level interception under strict conditions (in Germany, ‘Quellen-TK\u00dc’ under \u00a7 100a StPO), as a response to the increasing encryption of network traffic. For operators, this is not a practical solution, but it is part of the broader context in which encrypted DNS should be understood.<\/p>\n\n\n\n

A fourth strategy involves regulatory and policy engagement. Outside the EU, some governments block third-party resolvers or encrypted handshakes. In the EU, net-neutrality rules (Regulation (EU) 2015\/2120) make such blocking by operators difficult without a specific legal basis. These approaches are controversial and raise questions about network neutrality, user freedom, and technical feasibility.<\/p>\n\n\n\n

A tend\u00eancia geral para o uso da encripta\u00e7\u00e3o<\/h2>\n\n\n\n

O DNS encriptado faz parte de uma tend\u00eancia mais ampla no sentido da encripta\u00e7\u00e3o de todo o tr\u00e1fego de rede, impulsionada por preocupa\u00e7\u00f5es com a privacidade, pelas melhores pr\u00e1ticas de seguran\u00e7a e pelas configura\u00e7\u00f5es predefinidas das principais plataformas de software. O TLS 1.3, o ECH, o QUIC e outras tecnologias est\u00e3o a encriptar progressivamente uma parte cada vez maior dos metadados e conte\u00fados nos quais a interce\u00e7\u00e3o ao n\u00edvel da rede tradicionalmente se baseava. Cada passo nesta tend\u00eancia de encripta\u00e7\u00e3o reduz a visibilidade dispon\u00edvel para os operadores e, por extens\u00e3o, para a interce\u00e7\u00e3o legal.<\/p>\n\n\n\n

Os operadores devem reconhecer que a visibilidade ao n\u00edvel da rede de que t\u00eam historicamente beneficiado est\u00e1 a diminuir e continuar\u00e1 a diminuir. A resposta a esta tend\u00eancia n\u00e3o pode ser puramente t\u00e9cnica \u2014 exige o envolvimento com as entidades reguladoras, os organismos de normaliza\u00e7\u00e3o e as autoridades respons\u00e1veis pela aplica\u00e7\u00e3o da lei, a fim de desenvolver novas abordagens \u00e0 interce\u00e7\u00e3o legal que tenham em conta as realidades de um ambiente de rede fortemente encriptado.<\/p>\n\n\n\n

At the same time, operators must continue to deliver whatever interception data they are technically capable of providing. The encryption of DNS does not eliminate the operator’s legal obligation to intercept; it changes the scope of what can be intercepted. Operators must remove encryption they apply in the network or whose keys they help generate or exchange (in Germany \u00a7 8(3) TK\u00dcV). Third-party DoH or DoT traffic is handed over as captured. Operators must be transparent with law enforcement about these limitations and must ensure that their LI systems are updated to handle the reduced visibility gracefully \u2014 delivering the complete copy of the target\u2019s traffic, encrypted DNS included, without filtering it.<\/p>\n\n\n\n

Implica\u00e7\u00f5es em mat\u00e9ria de conformidade e presta\u00e7\u00e3o de informa\u00e7\u00f5es<\/h2>\n\n\n\n

Encrypted DNS does not reduce what an operator has to deliver: the complete copy of the target\u2019s traffic, including the encrypted DNS packets, still meets the obligation. What changes is what law enforcement can read from it, and operators should explain this when agencies ask why domain names are missing.<\/p>\n\n\n\n

As entidades reguladoras em algumas jurisdi\u00e7\u00f5es poder\u00e3o ter de atualizar os seus requisitos t\u00e9cnicos e expectativas para ter em conta a realidade do DNS encriptado. Os operadores podem desempenhar um papel construtivo neste processo, contribuindo com conhecimentos t\u00e9cnicos e perspetivas pr\u00e1ticas para orientar o desenvolvimento da regulamenta\u00e7\u00e3o. O pior cen\u00e1rio para todas as partes seria uma expectativa regulat\u00f3ria de que as operadoras forne\u00e7am dados aos quais n\u00e3o t\u00eam acesso por motivos t\u00e9cnicos \u2014 uma situa\u00e7\u00e3o que cria um risco de incumprimento sem, no entanto, proporcionar qualquer valor para a investiga\u00e7\u00e3o.<\/p>\n\n\n\n

Conclus\u00e3o<\/h2>\n\n\n\n

Encrypted DNS represents a significant shift in the balance between privacy and surveillance capability in telecommunications networks. DoH and DoT protect user privacy by preventing the observation of DNS queries by network intermediaries, but they also reduce the visibility available to lawful interception systems. Operators can help by offering their own encrypted DNS resolvers, leveraging alternative data sources, engaging with regulators on evolving requirements, and ensuring that their LI systems accurately reflect the data that is actually available. The trend toward comprehensive network encryption is irreversible, and operators that adapt proactively will be better positioned to maintain compliance and to provide meaningful support to law enforcement within the constraints of the evolving technical landscape.<\/p>\n\n\n

O debate em torno do DNS encriptado tamb\u00e9m destaca a tens\u00e3o entre os direitos individuais \u00e0 privacidade e as necessidades leg\u00edtimas das autoridades respons\u00e1veis pela aplica\u00e7\u00e3o da lei. Encontrar o equil\u00edbrio certo requer a colabora\u00e7\u00e3o entre especialistas em tecnologia, decisores pol\u00edticos, a sociedade civil e as autoridades respons\u00e1veis pela aplica\u00e7\u00e3o da lei. Os operadores encontram-se na intersec\u00e7\u00e3o destes interesses e t\u00eam a responsabilidade \u00fanica de garantir que as capacidades t\u00e9cnicas, as obriga\u00e7\u00f5es legais e as prote\u00e7\u00f5es de privacidade estejam alinhadas. Ao participarem ativamente no desenvolvimento de normas, em consultas regulamentares e em f\u00f3runs do setor, as operadoras podem ajudar a definir solu\u00e7\u00f5es que respeitem a privacidade, preservando simultaneamente a capacidade das sociedades democr\u00e1ticas de realizar vigil\u00e2ncia legal, em conformidade com o Estado de direito.<\/p>\n\n\n\n

Artigos relacionados<\/h2>\n\n\n\n

Para mais informa\u00e7\u00f5es sobre temas relacionados, consulte estes artigos:<\/p>\n\n\n\n