# Migration to anycast and RFC 8484 DoH As part of the launch of DoH on the dns.google domain and the well-known anycast IP addresses for Google Public DNS, the *Beta* DoH service on the dns.google.com domain *using other IP addresses* is now deprecated and will be turned down. The *experimental* version of the RFC 8484 API is also deprecated; **dns.google** /experimental is not supported, and **dns.google.com**/experimental will be migrated to dns.google/dns-query. > [!IMPORTANT] > **Important:** Google Public DNS supports the [JSON API](https://developers.google.com/speed/public-dns/docs/doh/json) at `/resolve` and plans to do so until there is a comparable standard for webapp-friendly DoH. ## Timeline | Date | Turndown step | |---|---| | ~~2019-07-23~~ **2019-08-01** | [`dns.google.com/experimental` redirects to `dns.google/dns-query`](https://developers.google.com/speed/public-dns/docs/doh/migration#step-1) -- `DONE` | | ~~2019-08-05~~ **2019-08-21** | [**dns.google.com** resolves to Google Public DNS **anycast** IP addresses](https://developers.google.com/speed/public-dns/docs/doh/migration#step-2) -- `DONE` | | **2019-09-24** | [**Old IP addresses** for dns.google.com redirect to **dns.google**](https://developers.google.com/speed/public-dns/docs/doh/migration#step-3) -- `DONE` | | **2020-06-23** | [**dns.google.com** redirects to **dns.google** everywhere](https://developers.google.com/speed/public-dns/docs/doh/migration#step-4) | Changes to this timeline are updated here and posted to [public-dns-announce](https://groups.google.com/forum/#!forum/public-dns-announce). Subscribe to that low-volume mailing list for updates. Thursday, August 1, 2019 : Requests for `https://dns.google.com/experimental` get HTTP 301 redirects to `https://dns.google/dns-query`. > *DoH applications using the JSON API at `/resolve` are not affected.* - To work with Google DoH, applications that used `/experimental` must support at least one of the following: - [URI Templates for configuration](https://developers.google.com/speed/public-dns/docs/doh/migration#uri-templates) - [Use `https://dns.google/dns-query` for RFC 8484 DoH](https://developers.google.com/speed/public-dns/docs/doh/migration#dns-query) - [Follow HTTP redirects](https://developers.google.com/speed/public-dns/docs/doh/migration#http-redirects) - RFC 8484 DoH applications must also implement *both* of the following: - [Accept and send `application/dns-message`](https://developers.google.com/speed/public-dns/docs/doh/migration#accept) - [Use Base64Url encoding for GET `dns` parameter](https://developers.google.com/speed/public-dns/docs/doh/migration#base64url) Wednesday, August 21, 2019 : `dns.google.com` resolves to the [Google Public DNS anycast IP addresses](https://developers.google.com/speed/public-dns/docs/using#google_public_dns_ip_addresses). > *This is transparent for most DoH applications, with no changes needed.*
Tuesday, September 24, 2019 : DoH queries to former dns.google.com IP addresses get HTTP 301 redirects to `https://dns.google/`. > *This may affect DoH applications using either the RFC 8484 or JSON API.* Applications that send DoH requests to hardcoded, configurable, or permanently cached *IP addresses* must support one or both of the following: - [Use Google Public DNS anycast IP addresses](https://developers.google.com/speed/public-dns/docs/doh/migration#anycast) - [Follow HTTP redirects](https://developers.google.com/speed/public-dns/docs/doh/migration#http-redirects) Tuesday, June 23, 2020 : DoH queries to dns.google.com on anycast IP addresses get HTTP 301 redirects to dns.google. > *This may affect DoH applications using either the RFC 8484 or JSON API.* To work with Google DoH, applications must support at least one of the following: - [URI Templates for configuration](https://developers.google.com/speed/public-dns/docs/doh/migration#uri-templates) - [Use dns.google domain for Google DoH](https://developers.google.com/speed/public-dns/docs/doh/migration#dns-google) - [Follow HTTP redirects](https://developers.google.com/speed/public-dns/docs/doh/migration#http-redirects) ## Changes for DoH clients ### Follow HTTP redirects DoH servers are just HTTP servers handling DNS queries. As such, they may return [HTTP redirects](https://developers.google.com/speed/public-dns/docs/doh#redirects) (codes 301, 302, 307, or 308), and DoH clients should follow those redirects just like any other HTTP client. Developers can check HTTP redirect support with `https://8.8.8.8/experimental` or `https://8.8.8.8/resolve` as the base for their DoH URLs; these return HTTP 301 redirects to `https://dns.google/dns-query` and `https://dns.google/resolve` (preserving any GET parameters). ### Use dns.google domain for Google DoH DoH applications should use dns.google instead of dns.google.com. Whether using the RFC 8484 or JSON API, any DoH applications with a hard-coded or configured list of DoH resolvers need to replace dns.google.com with dns.google in any URLs or URI templates. ### Use Google Public DNS anycast IP addresses DoH applications that send *DoH* requests to a hard-coded or configured list of IP addresses (even just for bootstrapping) need to replace former addresses of dns.google.com with the [Google Public DNS anycast IP addresses](https://developers.google.com/speed/public-dns/docs/using#google_public_dns_ip_addresses). ### URI Templates for configuration DoH applications should provide configurability for endpoints; the preferred and standard way to do this is with [URI templates](https://tools.ietf.org/html/rfc6570). DoH application developers with full configurability should notify users of the new URL (URI template: `https://dns.google/dns-query{?dns}`). ### Use `https://dns.google/dns-query` for RFC 8484 DoH DoH applications with a hard-coded or configured list of DoH resolvers need to replace the `https://dns.google.com/experimental` URL for the internet-draft DoH API with `https://dns.google/dns-query` and confirm full RFC 8484 compliance. The `/experimental` API (only available at dns.google.com) accepted queries using non-websafe Base64 encoding and `application/dns-udpwireformat` content type that are rejected by the `/dns-query` API (only available at dns.google). These differences are described in the following two sections. ### Use Base64Url encoding for GET `dns` parameter Use websafe [Base64Url](https://tools.ietf.org/html/rfc4648#section-5) encoding for the `dns` parameter in GET requests, replacing Base64 (`+` `/`) with (`-` `_`) and removing padding (`=`) characters. ### Accept and send `application/dns-message` Use [`application/dns-message`](https://tools.ietf.org/html/rfc8484#section-4.1) in the Accept header (and for RFC 8484 POST, in the Content-Type header) and accept it as the Content-Type of responses. Using the old Content-Type for POST will fail with 415 Unsupported Media Type. Applications using the old Content-Type in the Accept header will get responses with Content-Type application/dns-message. DoH applications that accept these, and do not ignore them because of unexpected Content-Type, will still work.