Method, device, and system for managing domain name resolution

1 . A method of managing Domain Name System (DNS) filtering, the method comprising:

blocking, by a network device, an end-device from accessing a domain for a predefined time duration, wherein the end-device is using an encrypted communication protocol to access a domain name resolution service;

determining, by the network device, failure of the end-device to switch to an unencrypted communication protocol to access the domain name resolution service, after expiry of the predefined time duration;

identifying, by the network device, the end-device as a headless device; and

permitting, by the network device, the end-device to access the domain name resolution service using the encrypted communication protocol.

2 . The method of claim 1 , further comprising retrieving a set of device attributes associated with the end-device from a device classification database.

3 . The method of claim 2 , further comprising updating a DNS preferences database with the set of device attributes and associated DNS preferences, in response to identifying the end-device as a headless device, wherein the DNS preferences comprise:

a communication protocol currently being used by the end-device to access the domain name resolution service; and

inability of the end-device to switch to the unencrypted communication protocol to access the domain name resolution service.

4 . The method of claim 1 , wherein the unencrypted communication protocol is one of DNS over Transmission Control Protocol (TCP) or DNS over User Datagram Protocol (UDP).

5 . The method of claim 1 , wherein the encrypted communication protocol is one of DNS over Transport Layer Security (TLS), DNS over Secure Socket Layer (SSL), or DNS over Hypertext Transfer Protocol Secure (HTTPS).

6 . A method of managing Domain Name System (DNS) filtering, the method comprising:

intercepting, by a network device, a request to access a domain from an end-device, wherein the end-device is using an encrypted communication protocol to access a domain name resolution service;

extracting, by the network device, a set of device attributes associated with the end-device from a device classification database;

determining, by the network device, whether the end-device is a headless device, based on the set of device attributes;

determining, by the network device, availability of DNS preferences associated with the end-device in a DNS preferences database, when the end-device is determined as a headless device; retrieving, by the network device, the DNS preferences in response to determining availability of the DNS preferences for the end-device; and

controlling, by the network device, use of the encrypted communication protocol and an unencrypted communication protocol by the end-device to access the domain name resolution service, based on the retrieved DNS preferences.

7 . The method of claim 6 , wherein the DNS preferences comprise:

a communication protocol currently being used by the end-device to access the domain name resolution service; and

inability of the end-device to switch to the unencrypted communication protocol to access the domain name resolution service.

8 . The method of claim 7 , wherein controlling comprises permitting the end-device to access the domain name resolution service using the encrypted communication protocol, based on the inability of the end-device to switch to the unencrypted communication protocol to access the domain name resolution service.

9 . The method of claim 6 , further comprising determining absence of the DNS preferences of the end-device in the DNS preferences database.

10 . The method of claim 9 , further comprising:

blocking the end-device from accessing the domain name resolution service for a predefined time duration;

determining failure of the end-device to switch to the unencrypted communication protocol to access the domain name resolution service after expiry of the predefined time duration; and

permitting the end-device to access the domain name resolution service using the encrypted communication protocol.

11 . A network device comprising:

a processor; and

a memory communicatively coupled to the processor and comprising processor instructions that when executed by the processor, cause the processor to:

block an end-device from accessing a domain for a predefined time duration, wherein the end-device is using an encrypted communication protocol to access a domain name resolution service;

determine failure of the end-device to switch to an unencrypted communication protocol to access the domain name resolution service after the expiry of the predefined time duration;

identify the end-device as a headless device; and

permit the end-device to access the domain name resolution service using the encrypted communication protocol.

12 . The network device of claim 11 , further comprising a device classification database configured to store device attributes for a plurality of first end-devices.

13 . The network device of claim 12 , wherein the processor instructions further cause the processor to retrieve a set of device attributes for the end-device from the device classification database.

14 . The network device of claim 11 , further comprising a DNS preferences database comprising device attributes of a plurality of second end-devices mapped to associated DNS preferences, wherein the DNS preferences mapped to a second end-device from the plurality of second end-devices comprise:

a communication protocol currently used by the second end-device to access the domain name resolution service; and

an ability of the second end-device to switch to an unencrypted communication protocol to access the domain name resolution service.

15 . The network device of claim 14 , wherein the processor instructions further cause the processor to update the DNS preferences database with the set of device attributes of the end-device and the associated DNS preferences, in response to identifying the end-device as a headless device, and wherein the DNS preferences associated with the end-device comprise:

a communication protocol currently used by the end-device to access the domain name resolution service; and

inability of the end-device to switch to the unencrypted communication protocol to access the domain name resolution service.

16 . A system for managing Domain Name System (DNS) filtering, the system comprising:

a network device comprising:

a processor; and

a memory communicatively coupled to the processor and comprising processor instructions that when executed by the processor, cause the processor to:

block an end-device from accessing a domain for a predefined time duration, wherein the end-device is using an encrypted communication protocol to access a domain name resolution service;

determine failure of the end-device to switch to an unencrypted communication protocol to access the domain name resolution service after the expiry of the predefined time duration;

identify the end-device as a headless device; and

permit the end-device to access the domain name resolution service using the encrypted communication protocol.

17 . The system of claim 16 , wherein the network device further comprises a local device classification database configured to store device attributes for a plurality of first end-devices.

18 . The system of claim 17 , wherein the system comprises a global device classification database stored on a cloud, wherein the local device classification database is periodically updated by synching with the global device classification database.

19 . The system of claim 16 , wherein the network device further comprises a local DNS preferences database comprising device attributes of a plurality of second end-devices mapped to associated DNS preferences, wherein the DNS preferences mapped to a second end-device from the plurality of second end-devices comprise:

a communication protocol currently used by the second end-device to access domain name resolution service; and

an ability of the second end-device to switch to an unencrypted communication protocol to access domain name resolution service.

20 . The system of claim 19 , wherein the system comprises a global DNS preferences database stored in a cloud, wherein the local DNS preferences database is periodically updated by synching with the global DNS preferences database.