IIJ Improves the DNS Security of its Connectivity Services

• PDF [527KB]

• Japanese Version

TOKYO-January 16, 2020-Internet Initiative Japan Inc. (IIJ, TSE1: 3774), one of Japan's leading Internet access and comprehensive network solutions providers, today announced that it has launched support for the latest standard domain name system (DNS) protocols, DNS over TLS (DoT) and DNS over HTTPS (DoH), as well as for DNS Security Extensions (DNSSEC). This DNS support is for the Full-service resolvers that IIJ provides through its Internet connectivity services, and this support improves users’ security when they connect to the Internet.

DNS security issues and trends in industry standards

DNS is a framework for linking IP addresses to domain names. When users access websites, PCs or smartphones query Full-service resolvers and communicate with the web server, based on the information in the DNS response. However, there is a risk that cyberattacks can maliciously use this framework to falsify DNS response data. These attacks can lead users to unwittingly visit fraudulent or fake sites, or expose them to many other types of threats. In the past, DNS protocols had various problems-including unencrypted communication channels and no way to confirm whether a Full-service resolver was legitimate-that required security improvements.

In response to this situation, the Internet Engineering Task Force (IETF)-an organization that formulates Internet technology standards-has standardized new DNS protocols that include frameworks for encrypting DNS queries and confirming the legitimacy of servers. One of the latest technologies is encrypted connection through DoT/DoH, while another is DNSSEC, which verifies server legitimacy using digital signatures.

1.IIJ's DoT/DoH support

With this launch, IIJ's connectivity services will now support DoT/DoH. DoT/DoH are technologies that encrypt queries to Full-service resolvers by transmitting DNS communications through secure TLS/HTTPS connections, thereby mitigating the danger of third-party communication interception or alteration, and enhancing privacy protection for users.

Since May 2019, IIJ has offered a beta version of the IIJ Public DNS Service with DoT/DoH support. This beta test allowed IIJ to confirm the utility of DoT/DoH implementation, verify the technologies, and accumulate know-how on operating DNS servers that support DoT/DoH. With this expertise, IIJ has now realized DoT/DoH support for its Full-service resolvers offered through its Internet connectivity services(*).

• (*)Mobile services support only DoH.

2.IIJ's DNSSEC support

DNSSEC uses digital signatures to verify that DNS data have not been altered. IIJ has continued to offer DNSSEC support in the authoritative name servers that manage domain data. With the spread of DNSSEC among authoritative name servers on the Internet, IIJ's Full-service resolvers now also support DNSSEC. This capability allows Full-service resolvers to verify the domain information using digital signatures included in responses from authoritative name servers, enabling the confirmation of server legitimacy. This technology further enhances the security of Internet use by preventing data leaks and other harm caused by altering domain data.

Service image

Service launch date

January 16, 2020

Fees

There are no additional fees for using DoT/DoH and DNSSEC.

IIJ continues to verify the latest DNS technologies-a core technology supporting the Internet-and implement them in its services, thereby contributing to secure Internet use.

The statements within this release contain forward-looking statements about our future plans that involve risk and uncertainty. These statements may differ materially from actual future events or results.

For inquiries, contact

IIJ Corporate Communications

• +81-3-5205-6310
• +81-3-5205-6377
• press@iij.ad.jp

• (*) All company names and service names used in this press release are the trademarks or registered trademarks of their respective owners.