ISPs required to implement DNS redirection by Sept 30

Internet service providers (ISPs) have been instructed by the Malaysian Communications and Multimedia Commission (MCMC) to implement domain name service (DNS) redirection by the end of this month.

This is according to an FAQ on the new measure that has been posted on Maxis Bhd’s website.

It is unclear when the FAQ was posted, but internet archiving services first started archiving the FAQ page last week.

On Aug 6, digital rights group Sinar Project sounded the alarm after its testing found that some ISPs - including Maxis - had been surreptitiously redirecting DNS requests intended for third-party services (such as Google DNS or Cloudflare’s 1.1.1.1 ) back to their own DNS servers.

While there are legitimate uses for using third-party DNS services, the new move also plugs a loophole that would otherwise allow internet users to access websites banned by the MCMC.

Sinar Project noted that redirecting users to unauthenticated websites different from the intended website can “pose a security risk and result in unexpected technical issues”.

Safety and users’ privacy assured

Nevertheless, Maxis assured customers that DNS redirection is safe and would not jeopardise users’ privacy.

“DNS redirection is generally considered a safe practice when implemented. It is being used to enhance security by preventing access to malicious or illegal websites.

“Internet service providers will follow the MCMC best practices and guidelines to maintain the lawful DNS redirection implementation process.

“Since other data traffic is not redirected, the data integrity is preserved,” it said.

It added it will follow MCMC guidelines to uphold privacy standards and protect users’ information throughout the redirection process.

Maxis customers who encounter issues with DNS redirection are told to contact the company for help resolving the issue.

When DNS redirection is working properly, it said, users accessing websites blocked by the MCMC will not be able to access them and will redirected here instead. 

The webpage mentioned currently appears to be inaccessible.

‘Safer internet experience’

Maxis echoed the MCMC’s explanation that the new measure will protect users from harmful and illegal content such as online gambling, pornography, and scams.

“The goal is to create a safer internet experience, especially for vulnerable users such as children and teenagers, by preventing access to inappropriate or dangerous sites,” it said.

It should be noted that the MCMC had also blocked legitimate news websites in the past - including Malaysiakini and the now-defunct The Malaysian Insider - as well as some websites critical of the government.

The MCMC maintains that a vast majority of blocked websites since 2022 fall within one of five categories: gambling, pornography, copyright violation, scams or illegal investment schemes, and prostitution.

Encrypted DNS traffic unaffected

Meanwhile, Maxis said there is no way to opt out of DNS redirection as this is a regulatory requirement enforced by the MCMC.

However, encrypted DNS traffic will not be affected by the new measure.

“Your encrypted DNS queries, including those using DNS over HTTPS (DoH) or DNS over TLS (DoT), remain secure and private. This means your queries continue to be protected from interception or tampering, ensuring your data and privacy are safeguarded […]

“To ensure your encrypted DNS traffic remains unaffected, you should use DNS over HTTPS (DoH) or DNS over TLS (DoT) for your DNS queries; these protocols encrypt your DNS traffic, enhancing privacy and security,” it said.

Sinar Project had similarly endorsed using secured connections to make DNS requests.

For context, a DNS service is akin to an address book used by computers for navigating the internet.

For example, when a user keys in a website’s URL such as “malaysiakini.com”, the computer would query a DNS server, which would respond by providing the internet protocol address (IP address; a set of numbers such as 104.22.21.197) for reaching the website.

By default, computers are typically configured to use the DNS servers provided by their ISPs such as TM, Maxis, Yes, or Time, but users with little know-how can also configure it to use a different DNS service if desired.

MCMC 'categorically denies' AIC objections to social media licensing

MCMC to engage with platforms before licensing implementation

MCMC: Licensing of social media providers to ensure users' safety

DNS measures help ensure safer online experience – MCMC

Internet providers plug loophole for accessing blocked websites

KINIGUIDE | How do other countries regulate social media?