4 ms·
(It's been a long time since I've actually set up a DNS server and am pretty fuzzy on some details - so I'm going to state this like a real nooby to hopefully g
by kylek 8y ago
(It's been a long time since I've actually set up a DNS server and am pretty fuzzy on some details - so I'm going to state this like a real nooby to hopefully get an ELI5 answer)
If I were to set up my own DoH server, would its queries to upstream (root??) servers (and subsequent recursed servers) be encrypted? (Simpler: does running a DNS server "on-premise", or even in the cloud, actually protect you from anything?)
- topranks 8y agoNo, DoH only deals with client to resolver encryption. Recursive lookups from the resolver to authoritative DNS servers from the root down are not encrypted. Really what you are doing is switching between telling your ISP all the domains you look up to telling Google/Cloudflare. Except your ISP can still see SNIs so you’re really just telling Google/Cloudflare in addition to your ISP.
- kylek 8y agoSeems all for not :| I don't suppose there are any proposals to replace how SNIs are transmitted? (sans-vpn/tor, that is) Does QUIC/HTTP[23] do anything different?