[Doh] [FYI] How Comcast Handles DNS Information

["Livingood, Jason" <[e-mail]>]

At the recent DoH meeting at IETF-104, and also in the side meeting that Stéphane organized, there was much discussion about how a primary motivation for centralized DoH was ISP DNS practices: specifically, NXDOMAIN redirection and DNS data collection and privacy.

I thought I’d take a moment here to confirm Comcast’s position on these issues. First, we don’t do NXDOMAIN redirection (see https://corporate.comcast.com/comcast-voices/comcast-domain-helper-shuts-down)  Second, our longstanding policy regarding customer DNS queries is simple: we do not track customers’ DNS data, sell it, or use it for advertising or marketing.  And even though Comcast processes more than 550 billion recursive DNS queries per day, it is our standard policy to delete all DNS queries from our systems’ logs every 24 hours, unless we need to research and resolve specific security or network performance issues.

We take DNS security very seriously and we were the first large ISP in the United States to fully implement DNSSEC validation (see https://corporate.comcast.com/comcast-voices/comcast-completes-dnssec-deployment) Whether it is DNSSEC or our early implementation of IPv6, we’re always interested in deploying valuable new standards and, just as many other ISPs are now doing, we continue to study how and when to deploy DoH and DoT in a manner that will minimize consumer disruptions while ensuring continued consumer privacy & security.

Regards,
Jason Livingood
Vice President – Technology Policy & Standards
Comcast