Google Public DNS

Google Public DNS is a Domain Name System (DNS) service offered to Internet users worldwide by Google. It functions as a recursive name server. Google Public DNS was announced on December 3, 2009,^[1] in an effort described as "making the web faster and more secure."^[2][3] As of 2018, it is the largest public DNS service in the world, handling over a trillion queries per day.^[4] Google Public DNS is not related to Google Cloud DNS, which is a DNS hosting service.

Service

The Google Public DNS service operates recursive name servers for public use at the four IP addresses listed below.^[5] These addresses are mapped to the nearest operational server by anycast routing.^[6]

Filters domains	No
Passes ECS	Yes
Validates DNSSEC	Yes
Via DoH	https://dns.google/dns-query
Via DoT	dns.google
Via IPv4	8.8.8.8 8.8.4.4
Via IPv6	2001:4860:4860::8888 2001:4860:4860::8844

The service does not use conventional DNS name server software, such as BIND, instead relying on a custom-designed implementation, conforming to the DNS standards set forth by the IETF. It fully supports the DNSSEC protocol since 19 March 2013. Previously, Google Public DNS accepted and forwarded DNSSEC-formatted messages but did not perform validation.^[7][8]

Some DNS providers practice DNS hijacking while processing queries, redirecting web browsers to an advertisement site operated by the provider when a nonexistent domain name is queried. The Google service correctly replies with a non-existent domain (NXDOMAIN) response.^[9]

The Google service also addresses DNS security. A common attack vector is to interfere with a DNS service to achieve redirection of web pages from legitimate to malicious servers. Google documents efforts to be resistant to DNS cache poisoning, including “Kaminsky Flaw” attacks as well as denial-of-service attacks.^[10]

DNS64

The Google Public DNS64 service operates recursive name servers for public use at the two IP addresses listed below for use with NAT64.^[11]

Filters domains	No
Passes ECS	Yes
Validates DNSSEC	Yes
Via DoH	https://dns64.dns.google/dns-query{?dns}
Via DoT	dns64.dns.google
Via IPv6	2001:4860:4860::6464 2001:4860:4860::64

Privacy

Google stated that for the purposes of performance and security, the querying IP address will be deleted after 24–48 hours, but Internet service provider (ISP) and location information are stored permanently on their servers.^[12][13][14]

History

In December 2009, Google Public DNS was launched with its announcement^[15] on the Official Google Blog by product manager Prem Ramaswami, with an additional post on the Google Code blog.^[16]

In January 2019, Google Public DNS adopted the DNS over TLS protocol.^[17]

DNSSEC

At the launch of Google Public DNS, it did not directly support DNSSEC. Although RRSIG records could be queried, the AD (Authenticated Data) flag was not set in the launch version, meaning the server was unable to validate signatures for all of the data. This was upgraded on 28 January 2013, when Google's DNS servers silently started providing DNSSEC validation information,^[18] but only if the client explicitly set the DNSSEC OK (DO) flag on its query.^[19] This service requiring a client-side flag was replaced on 6 May 2013 with full DNSSEC validation by default, meaning all queries will be validated unless clients explicitly opt-out.^[8]

Client subnet

Since June 2014, Google Public DNS automatically detects nameservers that support EDNS Client Subnet (ECS) options as defined in the IETF draft (by probing name servers at a low rate with ECS queries and caching the ECS capability), and will send queries with ECS options to such name servers automatically.^[20]

Censorship in Turkey

In March 2014, use of Google Public DNS was blocked in Turkey after it was used to circumvent the blocking of Twitter, which took effect on 20 March 2014 under court order. The block was the result of earlier remarks by Prime Minister Tayyip Erdogan who vowed to "wipe out Twitter" following damaging allegations of corruption in his inner circle. The method became popular after it was determined that a simple domain name block was used to enforce the ban, which would easily be bypassed by using an alternate DNS resolver. Activists distributed information on how to use the service, and spray-painted the IP addresses used by the service as graffiti on buildings. Following the discovery of this method, Google Public DNS was blocked entirely.^[21][22][23]

See also

• DNS over HTTPS
• EDNS Client Subnet
• Public recursive name server

References

1. Singel, Ryan (December 3, 2009). "Geez, Google Wants to Take Over DNS, Too". Wired. ISSN 1059-1028. Retrieved November 3, 2023.
2. "Introducing Google Public DNS". Official Google Blog. December 3, 2009. Retrieved November 3, 2023.
3. Stone, Brad (December 3, 2009). "Pondering Google's Move Into the D.N.S. Business". Bits Blog. Retrieved November 3, 2023.
4. "Google Public DNS turns 8.8.8.8 years old". Google Online Security Blog. Retrieved November 3, 2023.
5. Mario Bonilla (June 9, 2011). "Announcement on public-dns-announce". Retrieved October 10, 2012.
6. "Frequently Asked Questions | Public DNS". Google for Developers. Retrieved November 3, 2023.
7. "Frequently Asked Questions". Retrieved July 3, 2017.
8. "Google Public DNS Now Supports DNSSEC Validation". Google Code Blog. June 1, 2013.
9. Raphael, JR (December 3, 2009). "Google Public DNS and Your Privacy". PCWorld. Retrieved January 11, 2021.
10. "Google Public DNS Security Threats and Mitigations". Retrieved June 22, 2012.
11. "Google Public DNS64". Google. June 3, 2016. Retrieved May 26, 2020.
12. "Google Public DNS: Your Privacy". Google Inc. April 1, 2016. Retrieved September 5, 2016.
13. "Google Privacy Policy". March 31, 2014. Retrieved July 1, 2014.
14. "Google Public DNS and your privacy". PC World. December 4, 2009.
15. "Introducing Google Public DNS". Official Google Blog. December 3, 2009. Retrieved November 3, 2023.
16. "Introducing Google Public DNS". Google Code Blog. December 3, 2009.
17. Beiersmann, Stefan (January 10, 2019). "Google spendiert seinen öffentlichen DNS-Servern TLS-Verschlüsselung". ZDNet.de (in German). Retrieved January 11, 2021.
18. "Google's Public DNS does DNSSEC validation". nanog mailing list archives. January 29, 2013.
19. Huston, Geoff (July 17, 2013). "DNS, DNSSEC and Google's Public DNS Service". CircleID.
20. Wan, Shen (June 9, 2014). "Google Public DNS now auto-detects nameservers that support edns-client-subnet". Google Groups. Retrieved November 3, 2023.
21. "Turkish citizens use Google to fight Twitter ban". The Verge. March 21, 2014. Retrieved March 24, 2014.
22. "Twitter website 'blocked' in Turkey". BBC News. March 21, 2014. Retrieved November 3, 2023.
23. "'We'll eradicate Twitter': Turkey blocks Twitter access". PCWorld. Retrieved November 3, 2023.

External links

• Official developers blog
• Google Public DNS