Quad 9 – Measurement in the privacy-preserving public DNS service

In this episode of PING, we’re hearing from Darren Kara, who is a principal engineer at Quad 9. If you haven’t heard of Quad 9 It’s one of the oldest public DNS services, over 10 years old. An initiative of Packet Clearning House (PCH), IBM, The Global Cyber Alliance (GCA) and Switch Telecom in Switzerland. Quad9 now operates as a public-benefit not-for-profit foundation and is headquartered in Switzerland. Amongst the choices of public DNS from other providers like Google and Cloudflare, Quad 9 has two principal points: They focus on privacy of users, with a very strong prevention of information leakage from out of any given location they operate in, and they offer protection against Malware and Phishing. The first design goal means for measurement, they have a completely different model to the one we’re mostly used to, where packet samples or entire captures (as in the DNS OARC Day-in-the-life or DITL collection) are available for analysis: Nothing leaves the room which identifies the individual user. Only aggregates, and with changes to anonymise the source address. The second goal of protecting the user is the result of a collaboration with threat intelligence sources operating worldwide. Quad 9 is able to reflect on their feeds, and ensure DNS queries which pass through them don’t send people to known sources of attack, and is also able to feed back to the sources information which helps them refine their signal, and understand risks in different parts of the world. This too demands data anonymisation to ensure nothing about the end user leaks, and that the different intelligence feeds don’t get signals intended for another, with Quad 9 as the intermediary. Darren discusses their architecture, and how things work from a management and measurement perspective. He’d love to hear from sources of threat analysis in the Asia-Pacific region, to improve collaboration and coverage for the community at large. Why not get in touch at the Quad 9 contact page?