{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,22]],"date-time":"2026-04-22T19:13:10Z","timestamp":1776885190362,"version":"3.51.2"},"reference-count":27,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2025,7,29]],"date-time":"2025-07-29T00:00:00Z","timestamp":1753747200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,7,29]],"date-time":"2025-07-29T00:00:00Z","timestamp":1753747200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"National Key Research and Development Program of China","award":["2019QY1303,2019QY1301"],"award-info":[{"award-number":["2019QY1303,2019QY1301"]}]},{"name":"Strategic Priority Research Program of the Chinese Academy of Sciences","award":["XDC02040100"],"award-info":[{"award-number":["XDC02040100"]}]},{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"crossref","award":["U1836211"],"award-info":[{"award-number":["U1836211"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Beijing Natural Science Foundation","award":["JQ18011"],"award-info":[{"award-number":["JQ18011"]}]},{"DOI":"10.13039\/501100004739","name":"Youth Innovation Promotion Association of the Chinese Academy of Sciences","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100004739","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n          <jats:p>In recent years, DoE methods have been regarded as a novel trend within the realm of the DNS ecosystem. Measuring these DoE services in the wild can promote improvements in DoE methods and facilitate their widespread adoption. A primary requirement for measuring DoE methods is the discovery of these services. The discovery is relatively straightforward for DoT and DoQ, but complex for DoH since it shares port 443 with web services as suggested in RFC 8484. Although previous works primarily analyze the surface of the DoH service, they (1) result in long detection time and large traffic volume by adopting an enumeration strategy to discover the DoH service; (2) lack an in-depth analysis of the status of upper-layer DNS services. In this paper, we propose the E-DoH method for elegant, efficient, and in-depth DoH service measurement. First, we propose a measurement mechanism to enable a single DoH connection to accomplish multiple tasks including service discovery, correctness validation, and dependency construction with minimal backend configuration. Second, we propose a dynamic protocol negotiation strategy to enhance probing efficiency while significantly reducing the required traffic volume. Based on the above optimization methods, we conducted an exploration of the IPv4 space and performed an in-depth analysis of DoH based on the collected information. Through experiments, our approach demonstrates a remarkable 80% improvement in time efficiency and only requires 4\u201320% traffic volume to complete the detection task. In wild detection, our approach discovered 46k DoH services, which nearly doubles the number discovered by the state-of-the-art. This indicates the growing trend of DoH services. Based on the collected information, we present several intriguing conclusions about the current DoH service ecosystem.<\/jats:p>","DOI":"10.1186\/s42400-025-00390-5","type":"journal-article","created":{"date-parts":[[2025,7,29]],"date-time":"2025-07-29T03:02:55Z","timestamp":1753758175000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["E-DoH: elegantly detecting the depths of open DoH service on the internet"],"prefix":"10.1186","volume":"8","author":[{"given":"Cong","family":"Dong","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jiahai","family":"Yang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yun","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haoran","family":"Jiao","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Chenglong","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xia","family":"Yin","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yuling","family":"Liu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,7,29]]},"reference":[{"key":"390_CR1","unstructured":"Bart: DNS-over-HTTPS (DOH) Provider List (2023)"},{"key":"390_CR2","doi-asserted-by":"publisher","unstructured":"Chang L, Lu K, Li C, Zhang Z (2022) Zmap performance in open dns resolver discovery. In: 2022 2nd Asia-Pacific Conference on Communications Technology and Computer Science (ACCTCS), pp. 80\u201385 . https:\/\/doi.org\/10.1109\/ACCTCS53867.2022.00024","DOI":"10.1109\/ACCTCS53867.2022.00024"},{"key":"390_CR3","unstructured":"DNSCrypt\u2014List of Public DoH and DNSCrypt Servers. https:\/\/dnscrypt.info\/public-servers\/ (2023)"},{"key":"390_CR4","doi-asserted-by":"publisher","unstructured":"Deccio C, Davis J (2019) Dns privacy in practice and preparation. In: Proceedings of the 15th International Conference on Emerging Networking Experiments And Technologies, pp. 138\u2013143. ACM, Orlando Florida . https:\/\/doi.org\/10.1145\/3359989.3365435","DOI":"10.1145\/3359989.3365435"},{"key":"390_CR5","unstructured":"Encrypt DNS Traffic $$\\cdot$$ Cloudflare 1.1.1.1 Docs. https:\/\/developers.cloudflare.com\/1.1.1.1\/encryption\/ (2022)"},{"key":"390_CR6","doi-asserted-by":"publisher","unstructured":"Garc\u00eda S, Bogado J, Hynek K, Vekshin D, \u010cejka T, Wasicek A (2022) Large scale analysis of doh deployment on the internet. In: Atluri V, Di\u00a0Pietro R, Jensen CD, Meng W (eds) Computer Security \u2013 ESORICS 2022 vol. 13556, pp. 145\u2013165. Springer, Cham. https:\/\/doi.org\/10.1007\/978-3-031-17143-7_8","DOI":"10.1007\/978-3-031-17143-7_8"},{"key":"390_CR7","doi-asserted-by":"publisher","unstructured":"Hoffman PE, McManus P (2018) DNS queries over https (doh). Request for Comments RFC 8484, Internet Engineering Task Force (October). https:\/\/doi.org\/10.17487\/RFC8484","DOI":"10.17487\/RFC8484"},{"key":"390_CR8","doi-asserted-by":"crossref","unstructured":"Hoffman P, McManus P (2018) Rfc 8484: Dns queries over https (doh). RFC Editor","DOI":"10.17487\/RFC8484"},{"key":"390_CR9","doi-asserted-by":"crossref","unstructured":"Hu Z, Zhu L, Heidemann J, Mankin A, Wessels D, Hoffman P (2016) RFC 7858: Specification for DNS over transport layer security (TLS). RFC Editor","DOI":"10.17487\/RFC7858"},{"key":"390_CR10","doi-asserted-by":"publisher","unstructured":"Hu Z, Zhu L, Heidemann J, Mankin A, Wessels D, Hoffman PE (2016) Specification for dns over transport layer security (tls). Request for Comments RFC 7858, Internet Engineering Task Force. https:\/\/doi.org\/10.17487\/RFC7858","DOI":"10.17487\/RFC7858"},{"key":"390_CR11","doi-asserted-by":"publisher","unstructured":"Huitema C, Dickinson S, Mankin A (2022) DNS over dedicated quic connections. Request for Comments RFC 9250, Internet Engineering Task Force (May). https:\/\/doi.org\/10.17487\/RFC9250","DOI":"10.17487\/RFC9250"},{"key":"390_CR12","doi-asserted-by":"publisher","unstructured":"Huitema C, Dickinson S, Mankin A (2022) DNS over Dedicated QUIC Connections. RFC Editor. https:\/\/doi.org\/10.17487\/RFC9250 . https:\/\/www.rfc-editor.org\/info\/rfc9250","DOI":"10.17487\/RFC9250"},{"key":"390_CR13","doi-asserted-by":"publisher","unstructured":"Izhikevich L, Akiwate G, Berger B, Drakontaidis S, Ascheman A, Pearce P, Adrian D, Durumeric Z (2022) Zdns: A fast dns toolkit for internet measurement. In: Proceedings of the 22nd ACM Internet Measurement Conference, pp. 33\u201343. ACM, Nice France. https:\/\/doi.org\/10.1145\/3517745.3561434","DOI":"10.1145\/3517745.3561434"},{"key":"390_CR14","doi-asserted-by":"publisher","unstructured":"Jerabek K, Rysavy O, Burgetova I (2023) Analysis of well-known DNS over https resolvers. In: 2023 IEEE 13th Annual Computing and Communication Workshop and Conference (CCWC), pp. 0516\u20130524.https:\/\/doi.org\/10.1109\/CCWC57344.2023.10099347","DOI":"10.1109\/CCWC57344.2023.10099347"},{"key":"390_CR15","doi-asserted-by":"crossref","unstructured":"Li R, Jia X, Zhang Z, Shao J, Lu R, Lin J, Jia X, Wei G (2023) A longitudinal and comprehensive measurement of DNS strict privacy. IEEE\/ACM Transactions on Networking","DOI":"10.1109\/TNET.2023.3262651"},{"key":"390_CR16","doi-asserted-by":"publisher","unstructured":"Lu C, Liu B, Li Z, Hao S, Duan H, Zhang M, Leng C, Liu Y, Zhang Z, Wu J (2019) An end-to-end, large-scale measurement of dns-over-encryption: How far have we come? In: Proceedings of the Internet Measurement Conference, pp. 22\u201335. ACM, Amsterdam Netherlands . https:\/\/doi.org\/10.1145\/3355369.3355580","DOI":"10.1145\/3355369.3355580"},{"key":"390_CR17","doi-asserted-by":"publisher","first-page":"109081","DOI":"10.1016\/j.comnet.2022.109081","volume":"213","author":"M Luo","year":"2022","unstructured":"Luo M, Yao Y, Xin L, Jiang Z, Wang Q, Shi W (2022) Measurement for encrypted open resolvers: applications and security. Comput Netw 213:109081. https:\/\/doi.org\/10.1016\/j.comnet.2022.109081","journal-title":"Comput Netw"},{"key":"390_CR18","doi-asserted-by":"publisher","unstructured":"Luo M, Xin L, Yao Y, Jiang Z, Wang Q, Shi W (2023) Who are querying for me? egress measurement for open dns resolvers. In: 2023 26th International Conference on Computer Supported Cooperative Work in Design (CSCWD), pp. 1544\u20131550. https:\/\/doi.org\/10.1109\/CSCWD57460.2023.10152616","DOI":"10.1109\/CSCWD57460.2023.10152616"},{"key":"390_CR19","doi-asserted-by":"publisher","unstructured":"Nawrocki M, Koch M, Schmidt TC, W\u00e4hlisch M (2021) Transparent forwarders: An unnoticed component of the open DNS infrastructure. In: Proceedings of the 17th International Conference on Emerging Networking EXperiments and Technologies. CoNEXT \u201921, pp. 454\u2013462. Association for Computing Machinery, New York, NY, USA . https:\/\/doi.org\/10.1145\/3485983.3494872","DOI":"10.1145\/3485983.3494872"},{"issue":"1","key":"390_CR20","doi-asserted-by":"publisher","first-page":"76","DOI":"10.1109\/TNET.2021.3105599","volume":"30","author":"J Park","year":"2022","unstructured":"Park J, Jang R, Mohaisen M, Mohaisen D (2022) A large-scale behavioral analysis of the open DNS resolvers on the internet. IEEE\/ACM Trans Netw 30(1):76\u201389. https:\/\/doi.org\/10.1109\/TNET.2021.3105599","journal-title":"IEEE\/ACM Trans Netw"},{"key":"390_CR21","doi-asserted-by":"publisher","unstructured":"Park J, Khormali A, Mohaisen M, Mohaisen A (2019) Where are you taking me? behavioral analysis of open dns resolvers. In: 2019 49th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN), pp. 493\u2013504. IEEE, Portland, OR, USA . https:\/\/doi.org\/10.1109\/DSN.2019.00057","DOI":"10.1109\/DSN.2019.00057"},{"key":"390_CR22","unstructured":"Public Resolvers: Dnsprivacy.Org. https:\/\/dnsprivacy.org\/public_resolvers\/ (2023)"},{"key":"390_CR23","doi-asserted-by":"publisher","unstructured":"Schomp K, Bhardwaj O, Kurdoglu E, Muhaimen M, Sitaraman RK (2020) Akamai DNS: Providing authoritative answers to the world\u2019s queries. In: Proceedings of the Annual Conference of the ACM Special Interest Group on Data Communication on the Applications, Technologies, Architectures, and Protocols for Computer Communication, pp. 465\u2013478. ACM, Virtual Event USA . https:\/\/doi.org\/10.1145\/3387514.3405881","DOI":"10.1145\/3387514.3405881"},{"key":"390_CR24","doi-asserted-by":"publisher","unstructured":"Xu W, Li X, Lu C, Liu B, Duan H, Zhang J, Chen J, Wan T (2023) Tsuking: Coordinating DNS resolvers and queries into potent dos amplifiers. In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. CCS \u201923, pp. 311\u2013325. Association for Computing Machinery, New York, NY, USA. https:\/\/doi.org\/10.1145\/3576915.3616668","DOI":"10.1145\/3576915.3616668"},{"key":"390_CR25","doi-asserted-by":"publisher","unstructured":"Yang M, Yu Y, Mi X, Tang S, Guo S, Li Y, Zheng X, Duan H (2022) An extensive study of residential proxies in China. In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pp. 3049\u20133062. ACM, Los Angeles CA USA . https:\/\/doi.org\/10.1145\/3548606.3559377","DOI":"10.1145\/3548606.3559377"},{"issue":"1","key":"390_CR26","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3579440","volume":"7","author":"M Zhang","year":"2023","unstructured":"Zhang M, Li X, Liu B, Lu J, Zhang Y, Chen J, Duan H, Hao S, Zheng X (2023) Detecting and measuring security risks of hosting-based dangling domains. Proceed ACM Measurement Anal Comput Syst 7(1):1\u201328. https:\/\/doi.org\/10.1145\/3579440","journal-title":"Proceed ACM Measurement Anal Comput Syst"},{"key":"390_CR27","unstructured":"Zheng X, Lu C, Peng J, Yang Q, Zhou D, Liu B, Man K, Hao S, Duan H, Qian Z Poison over troubled forwarders: A cache poisoning attack targeting DNS forwarding devices"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00390-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-025-00390-5\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00390-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,29]],"date-time":"2025-07-29T03:03:01Z","timestamp":1753758181000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-025-00390-5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7,29]]},"references-count":27,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,12]]}},"alternative-id":["390"],"URL":"https:\/\/doi.org\/10.1186\/s42400-025-00390-5","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,7,29]]},"assertion":[{"value":"19 December 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"6 March 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"29 July 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no Conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"101"}}