3 ms·
people invented other security things inside of dns protocol to avoid having the added bandwidth. i dont think it's reasonable to say that everyone can handle t
by vectorEQ 9y ago
people invented other security things inside of dns protocol to avoid having the added bandwidth. i dont think it's reasonable to say that everyone can handle the increased load nowadays.
However, i've been thinking of this, for enterprise, you could build a dns server which servers over TLS connections, and then put a local dns proxy on clients which receives on 127.0.0.1 and sends out tls to the custom dns server.
That way any local network connections would be encrypted to passive listeners on the network.
recursive queries would go onto the internet plaintext to 'normal' dns servers.
- Skunkleton 9y agoYou can already do this with existing tech. When a DHCP lease is acquired, you also get DNS server information. If you are concerned about the DNS packets being encrypted on your local network, then you can do that already as well by intercepting them with a local firewall and sending them across a tunnel. IMO, the purpose of DOH is to address semi hostile environments like the free Wifi at the Airport. It is kind of like a VPN for just your DNS traffic.