4 ms·
I stumbled upon this when researching wether it was something to set up with my pi as DSN resolver but it was kinda a pita, does implementing DoT would be faste
by tatoalo 8y ago
I stumbled upon this when researching wether it was something to set up with my pi as DSN resolver but it was kinda a pita, does implementing DoT would be faster?
- sligor 8y agofor speed the ultimate solution would be DNS over HTTP/3 (DNS-over-HTTP-over-QUIC)
- dochtman 8y agoIn that case, the HTTP part would probably just be working against you. Fortunately, people are working on DNS over QUIC: https://datatracker.ietf.org/doc/draft-huitema-quic-dnsoquic/ https://datatracker.ietf.org/doc/draft-huitema-quic-dnsoquic...
- gsich 8y agoReinvention of the wheel
- sligor 8y agoHTTP only adds a small size overhead due to header formatting but it won't add latency, and DNS requests are in general dominated by connection latency (outside of local network)
- londons_explore 8y agoHTTP adds latency for the first request to a server, since you will have to do the 1-RTT certificate and key exchange before sending your HTTP request. For many use-cases, that penalty will be paid on every request rather than just the first request, because many DNS resolution libraries aren't designed to have persistent state, so every time the library is used, it will have to set up a new connection to the server from scratch.
- jimktrains2 8y agoI think you're confusing http(s) and tls. Http(1) is a request/response protocol. Tls is the stream encryption and key negotiation protocol most heavily used. Also, tls1.3 adds 0rtt for subsequent cqlls to the same server.
- sligor 8y agoyou have also to do this with plain QUIC or with plain TLS adding HTTP on top of both doesn't add RTT, the point was (DNS over QUIC) vs (DNS over HTTP over QUIC)
- Avamander 8y agoAre there any actual implementations being worked on?
- zamadatix 8y agoIf "apt install bind9" (or whatever package manager your distro uses) and editing ~8 lines from 2 text files to make it a secure caching forwarder was too complicated I don't think this would be any easier since it's, at this point, still out of the norm.
- bluejekyll 8y agoAll the major DoH providers appear to also support DoT, so DoT is a viable option. Also it is easier to implement, as it can just be a abstraction of existing implementations over DNS over TCP.
- tatoalo 8y agoI've seen your trust-dns rust-based repo, raspian is supported, I'll give it a try! Thanks
- bluejekyll 8y agoCool, let me know if there's anything there you'd like to see. I'm in the process of working on a system resolver, but first have to refactor a bunch of stuff. We'll see how that goes.