CODoH: Privacy-Preserving Caching for Oblivious DNS over HTTPS
Authors: Pankaj Niroula (William & Mary), Lily Gloudemans (William & Mary), Aashutosh Poudel (William & Mary), Collin MacDonald (William & Mary), Stephen Herwig (William & Mary)
Volume: 2026
Issue: 4
Pages: 608–627
DOI: https://doi.org/10.56553/popets-2026-0137
Artifact: Available, Functional
Abstract: Oblivious DNS over HTTPS (ODoH) enhances DNS privacy by routing queries through a proxy so that no single party can link a client's IP address with its DNS queries. However, because ODoH encrypts each query individually, the proxy cannot cache responses. We present CODoH (Cacheable Oblivious DNS over HTTPS), a cacheable extension to ODoH that reduces DNS resolution latency while preserving ODoH's separation of knowledge. CODoH places a proxy-side cache inside a trusted execution environment--namely, an Intel SGX enclave--and uses end-to-end encryption to ensure that the proxy never learns plaintext queries or cached responses. To prevent caching from becoming a new inference surface, CODoH defends against cache-state probing and set-difference (bracketing) attacks with (i) cover responses supplied by the resolver, (ii) batched cache updates that mix many clients' inserts, and (iii) an oblivious RAM (ORAM) backend that hides cache access patterns. CODoH also enforces correctness and freshness of cached records via resolver authorization and replay protection. We implement CODoH as CoreDNS extensions and evaluate it on an Azure SGX testbed. CODoH reduces median latency by 2.7x over ODoH on cache hits (18.0 vs. 48.0 ms) and by 2.2x under Zipf traffic (22.3 vs. 48.6 ms), with under 1 ms of SGX overhead.
Keywords: DNS, ODoH, Intel SGX, ORAM
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
