Recent concerns over the privacy implications of the Domain Name System (DNS) have led to encrypting DNS queries and responses through protocols like DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT). While the trend towards encryption is a positive development, the resulting centralization of the DNS has fomented tussles involving ISPs, browser and device vendors, content delivery networks, and users. Current deployment trends, should they continue, result in dynamics that will increase barriers to entry to competition and threaten consumer protection. This development makes it necessary for us to re-think name resolution to allow tussles to play out within the context of the design of the Internet architecture. This paper articulates several current DNS tussles and offers principles to guide system design and implementation such that all stakeholders in the space could participate. We then explore how a refactored client DNS mechanism can open up new possibilities for de-centralized name resolution, preserving the benefits of encrypted DNS while satisfying other architectural desiderata, including performance, resilience, and privacy.

翻译：最近对域名系统(DNS)的隐私影响的关切导致通过DNS-over-HTTPS(DoH)和DNS-over-TLS(DoT)等协议加密DNS查询和答复。虽然加密趋势是一个积极的发展,但由此产生的DNS集中化已经产生了涉及ISP、浏览器和装置供应商、内容传送网络和用户的拖网。目前的部署趋势如果继续下去,将导致增加进入竞争的障碍和威胁消费者保护的动态。这种发展使我们有必要重新思考名称解决办法,以便让Tussles在互联网结构设计中玩耍。本文阐述了目前DNS的几条DNS拖线,并提出了指导系统设计和实施的原则,使空间的所有利益攸关方都能参与其中。然后我们探讨重新设置的客户 DNS机制如何为分散名称的解析开辟新的可能性,保留加密DNS的好处,同时满足其他建筑结构的脱边线,包括性能、复原力和隐私。