3 ms·
DNS Queries over HTTPS.. which implies TCP. Weren't TCP DNS requests avoided like the plague? And why wrap DNS in HTTPS instead of just TLS if you are going dow
by AnaniasAnanas 8y ago
DNS Queries over HTTPS.. which implies TCP. Weren't TCP DNS requests avoided like the plague? And why wrap DNS in HTTPS instead of just TLS if you are going down the TCP route?
Why not DNSCrypt which is already supported by a lot of servers? Or DNSCurve.. or DNS over QUIC.
- Spivak 8y agoYou do both. Both Google and Cloudflare run DNSoTLS on port 853 and DNSoHTTPS on port 443. DNSoTLS and DNSoHTTPS in their short lives have already gained more traction than DNSCrypt ever got. DNSoQUIC is already in the pipeline.
- jedisct1 8y ago> DNSoTLS and DNSoHTTPS in their short lives have already gained more traction than DNSCrypt ever got I'm not convinced at all that this is true. Cisco, Comodo, Infoblox, Yandex, support DNSCrypt only in their products. They have no reason to switch to protocols that would require 10x more traffic. OpenNIC secure resolvers are all DNSCrypt. Cleanbrowsing resolvers probably get a lot of connections over DNSCrypt as well. I run both public resolvers accessible over DoH and DNSCrypt, and the traffic over DoH is negligible compared to the DNSCrypt one.