3 ms·
We did the same thing w/ JSON responses: https://www.openresolve.com/ https://www.openresolve.com/ This is a bad idea outside of experimentation. Not to be use
by davidu 10y ago
We did the same thing w/ JSON responses: https://www.openresolve.com/ https://www.openresolve.com/
This is a bad idea outside of experimentation. Not to be used for production.
If you want to secure DNS look at QUIC, TLS, or my favorite, DNSCrypt (which I funded).
- prewett 10y agoWhy is this a bad idea? You can't just say "it's bad" with no justification. As a user, I can sure think of some countries with broken Internet access where this would come in handy.
- davidu 10y agoI'll rephrase, it's way better accomplished with UDP without sacrificing security in the ways I list. Running DNS over HTTPS over TCP isn't needed. It doesn't solve a problem. Doing JSON DNS for OOB DNS checks is useful since most applications speak HTTP. :-)
- stevekemp 10y agoYup I threw together a toy too: https://dns-api.org/ https://dns-api.org/ For debugging and diagnostics it is useful, for querying via a local resolver not so good.
- sashametro 10y agoNote that although it is not documented, when you query the Google DNS-over-HTTPS service from Chrome, it will usually use QUIC. You can check this at chrome://net-internals/#quic, and will probably see something like this (look DNS/HTTPS/QUIC/UDP/IPv6!): dns.google.com:443 true QUIC_VERSION_34 [2607:f8b0:400d:c03::8a]:443 10544469510527000173 0 None 2 9 0 9 true An independent implementation of QUIC (are there any outside of browsers?) would probably work much the same, modulo any changes during the ongoing standardization of QUIC.