The Domain Name System (DNS) has long been one of the most valuable data sources for lawful interception and network intelligence. DNS queries reveal which websites a user visits, which services they access, and which applications they use, even when the rest of the traffic is encrypted. For decades, DNS traffic has been transmitted in plaintext, making it readily accessible to network-level interception. The emergence of encrypted DNS protocols — DNS over HTTPS (DoH) and DNS over TLS (DoT) — is fundamentally changing this landscape, with significant implications for 合法截获能力.
本文探讨了DoH和DoT的工作原理、被采用的原因、它们对合法截获的影响，以及在DNS流量日益加密的环境下，运营商应采取哪些措施以履行其合规义务。.
运营商面临的加密DNS挑战
Traditional DNS resolution uses port 53 (mostly UDP, with TCP for larger responses), transmitting queries and responses in plaintext. Anyone with access to the network path between the user and the DNS resolver — including the operator, intermediate network elements, and potential eavesdroppers — can observe the DNS queries and determine which domain names the user is resolving.
DNS over TLS (DoT), defined in RFC 7858, encrypts DNS traffic by wrapping it in a TLS connection on TCP port 853. The DNS queries and responses are encrypted in transit, preventing observation by intermediaries. However, the use of a dedicated port (853) makes DoT traffic identifiable at the network level — an observer can determine that DNS resolution is occurring, even though the content of the queries is encrypted. A third protocol, DNS over QUIC (DoQ, RFC 9250), runs on UDP port 853. Oblivious DoH (RFC 9230) additionally hides the user’s IP address from the resolver.
DNS over HTTPS (DoH), defined in RFC 8484, takes encryption a step further by tunnelling DNS traffic within standard HTTPS connections on port 443 (TCP, or UDP when HTTP/3 over QUIC is used). Because DoH uses ordinary HTTPS on port 443, its content cannot be separated from web traffic, although connections to well-known public resolvers can still be recognised by their addresses. DoH effectively hides DNS resolution within the vast volume of encrypted web traffic that traverses modern networks.
这两种协议都旨在通过防止网络中间人监视 DNS 查询来保护用户隐私。 主要浏览器供应商——包括 Mozilla Firefox 和 Google Chrome——已实现了对 DoH 的支持，部分操作系统现在也原生支持 DoH 和 DoT。在隐私倡导、浏览器默认设置以及加密所有网络流量这一更广泛趋势的推动下，加密 DNS 的采用正在加速。.
对合法截获的影响
The encryption of DNS traffic has a direct and significant impact on lawful interception capabilities. Plaintext DNS queries have traditionally been visible to investigators inside the content of communication (CC): the IP copy of the target’s traffic includes every DNS packet, providing a detailed record of the target’s online activity. When a target visits a website, sends an email, or uses an application, the corresponding DNS queries reveal the domain names involved, even when the content of the communication is encrypted.
借助 DoH 和 DoT，如果目标设备配置为使用非运营商运营的加密 DNS 解析器，运营商便无法在网络层监视 DNS 查询。 在设备与解析器之间，DNS 解析过程是端到端加密的，如果无法获取 TLS 会话密钥，运营商的网络设备就无法解密这些查询。.
This loss of DNS visibility affects real-time interception: the IP copy of the target’s traffic still contains every DNS packet, but with DoH and DoT those packets are encrypted, so the LEA loses the domain names it used to read from them. Encrypted DNS does not affect retained data: data retention rules, where they apply, cover subscriber and IP-assignment records. They do not cover DNS queries or browsing history, which in Germany are expressly excluded from data retention (§ 176(5) TKG).
当目标使用第三方 DoH 解析器（例如由 Cloudflare、Google 或其他提供商运营的解析器）而非运营商自身的 DNS 基础设施时，这种影响最为显著。 在这种情况下，DNS查询完全在运营商网络之外进行解析，运营商对此毫无访问权限。如果目标使用运营商自有的支持DoT或DoH的DNS解析器，运营商仍可在解析器层级访问查询数据，但无法在中间网络节点获取相关数据。.
运营商的风险缓解策略
Operators cannot prevent the adoption of encrypted DNS, but they can implement strategies to mitigate its impact on lawful interception. The first strategy is to operate their own DoH and DoT resolvers and to encourage their subscribers to use these resolvers, for example by advertising them through DDR (RFC 9462) or DNR (RFC 9463) so that devices upgrade to the operator’s encrypted resolver automatically. If the operator runs the encrypted resolver, an interception point at the resolver can still see a target’s queries in plaintext once a valid order is in force. This is not a reason to log all subscribers’ DNS: keeping such data needs its own legal basis. This approach preserves DNS visibility for lawful interception while still providing subscribers with the privacy benefits of encrypted DNS against third-party observation.
The second strategy involves using alternative data sources to reconstruct the information that DNS queries previously provided. Server Name Indication (SNI) in TLS handshakes provides the domain name of the server that the client is connecting to, and this information has traditionally been transmitted in plaintext. However, Encrypted Client Hello (ECH, RFC 9849, published 2026, the successor to ESNI) now encrypts the SNI as well, wherever browser and server support it, further reducing visibility. IP address analysis can also provide some information about which services a target is accessing, but the widespread use of content delivery networks (CDNs) and shared hosting means that IP-to-domain mapping is often ambiguous.
The third strategy is to implement interception at the application layer or at the device level, rather than relying solely on network-level data. This approach is beyond the scope of traditional telecommunications interception, but some jurisdictions already permit device-level interception under strict conditions (in Germany, ‘Quellen-TKÜ’ under § 100a StPO), as a response to the increasing encryption of network traffic. For operators, this is not a practical solution, but it is part of the broader context in which encrypted DNS should be understood.
A fourth strategy involves regulatory and policy engagement. Outside the EU, some governments block third-party resolvers or encrypted handshakes. In the EU, net-neutrality rules (Regulation (EU) 2015/2120) make such blocking by operators difficult without a specific legal basis. These approaches are controversial and raise questions about network neutrality, user freedom, and technical feasibility.
加密技术的广泛发展趋势
加密DNS是网络流量全面加密这一更广泛趋势的一部分，这一趋势由隐私问题、安全最佳实践以及主要软件平台的默认配置所推动。 TLS 1.3、ECH、QUIC 及其他技术正在逐步加密更多元数据和内容——而网络层拦截传统上正是依赖这些信息。这一加密趋势的每一步，都减少了运营商所能获取的信息，进而也限制了合法拦截的范围。.
运营商必须认识到，他们过去所享有的网络级可视性正在下降，并且还将继续下降。应对这一趋势不能仅靠技术手段——这需要与监管机构、标准制定机构和执法部门开展合作，以制定符合高度加密网络环境现实情况的合法截获新方法。.
At the same time, operators must continue to deliver whatever interception data they are technically capable of providing. The encryption of DNS does not eliminate the operator’s legal obligation to intercept; it changes the scope of what can be intercepted. Operators must remove encryption they apply in the network or whose keys they help generate or exchange (in Germany § 8(3) TKÜV). Third-party DoH or DoT traffic is handed over as captured. Operators must be transparent with law enforcement about these limitations and must ensure that their LI systems are updated to handle the reduced visibility gracefully — delivering the complete copy of the target’s traffic, encrypted DNS included, without filtering it.
对合规与报告的影响
Encrypted DNS does not reduce what an operator has to deliver: the complete copy of the target’s traffic, including the encrypted DNS packets, still meets the obligation. What changes is what law enforcement can read from it, and operators should explain this when agencies ask why domain names are missing.
某些司法管辖区的监管机构可能需要更新其技术要求和预期，以适应加密DNS的现实情况。运营商可以通过提供技术专长和实践见解，为监管政策的制定提供参考，从而在此过程中发挥建设性作用。 对所有相关方而言，最糟糕的结果莫过于监管机构要求运营商提供其技术上无法获取的数据——这种情况不仅会带来合规风险，却无法为调查提供任何价值。.
结论
Encrypted DNS represents a significant shift in the balance between privacy and surveillance capability in telecommunications networks. DoH and DoT protect user privacy by preventing the observation of DNS queries by network intermediaries, but they also reduce the visibility available to lawful interception systems. Operators can help by offering their own encrypted DNS resolvers, leveraging alternative data sources, engaging with regulators on evolving requirements, and ensuring that their LI systems accurately reflect the data that is actually available. The trend toward comprehensive network encryption is irreversible, and operators that adapt proactively will be better positioned to maintain compliance and to provide meaningful support to law enforcement within the constraints of the evolving technical landscape.
围绕加密DNS的争论也凸显了个人隐私权与执法部门的正当需求之间的矛盾。要找到恰当的平衡点，需要技术专家、政策制定者、公民社会和执法部门通力合作。运营商处于这些利益的交汇点，肩负着确保技术能力、法律义务和隐私保护相协调的独特责任。 通过积极参与标准制定、监管磋商和行业论坛，运营商有助于制定既尊重隐私，又能维护民主社会依据法治原则开展合法监控能力的解决方案。.
相关文章
如需进一步了解相关主题，请浏览这些文章：
外部资源
以下外部资源提供了更多背景资料和官方文件：
