4 ms·

But the proper solution for that is DNS-over-TLS and picking or running your own recursive DNS resolver.

by mtsr 7y ago

CogitoCogito 7y ago
Is it not possible to have a recursive DNS resolver with DNS over HTTPS? I.e. are their more differences between DoH and DNS over TLS than just the port number?
- mercora 7y ago
  i think DoH is DNS wireformat via http over TLS whereas DNS over TLS is the plain wireformat over TLS. EDIT: so for DoH you would need to speak HTTP but for DNS over TLS you only need to wrap TLS around for example by using stunnel or something.
  - CogitoCogito 7y ago
    Sorry if I'm dense, but that would mean that the two protocols _are_ the same except for port number for practical purposes right? I mean there's no reason why the same actions could be taken when running straight wireformat vs over http right? edit: In response to your edit :) So is the main objection to this that it breaks traditional layering then? E.g. here's a post in a thread that I found a bit helpful: https://old.reddit.com/r/privacy/comments/89pr15/dnsoverhttps_vs_dns_overtls_vs_dnscrypt/dwzk7g3/ https://old.reddit.com/r/privacy/comments/89pr15/dnsoverhttp... (The rest of the thread is interesting as well.) I guess one downside with DoH is that now there's a larger incentive to break through your https in general?
    - mercora 7y ago
      i was only responding to your question whether there is any difference between the two beside the port number used which there is, in a significant way. You can not point a DoH client to a DNS over TLS server or vice versa. That said there is no reason a DoH server could not be recursive or consult a traditional (probably recursive) resolver for its response. I think the only benefit of DoH is that is unlikely to be blocked. Otherwise it feels more like a hack and at least i am not concerned about OSI models ;) Actually, i tried to setup a DNS over TLS server some weeks ago but while it worked like intended i had a hard time to get reasonable response times even after somewhat serious fine tuning for the session setup (i used haproxy at server side). But this was mainly caused by the fact that systemd-resolved established a new connection for each and every request and i did not find a stub resolver that did not either.
      - CogitoCogito 7y ago
        > i was only responding to your question whether there is any difference between the two beside the port number used which there is, in a significant way. You can not point a DoH client to a DNS over TLS server or vice versa. That said there is no reason a DoH server could not be recursive or consult a traditional (probably recursive) resolver for its response. > I think the only benefit of DoH is that is unlikely to be blocked. Otherwise it feels more like a hack and at least i am not concerned about OSI models ;) Thanks for the response, but I'm still a little confused. If you live in the DoH stack you must stay there sure, but the same apparently applies to the DNS over TLS. What to you exactly is hacky about the DoH method if you don't care about the layering violations?

But the proper solution for that is DNS-over-TLS and picking or running your own recursive DNS resolver.

by mtsr 7y ago

But the proper solution for that is DNS-over-TLS and picking or running your own recursive DNS resolver.

Is it not possible to have a recursive DNS resolver with DNS over HTTPS? I.e. are their more differences between DoH and DNS over TLS than just the port number?

mercora 7y ago
i think DoH is DNS wireformat via http over TLS whereas DNS over TLS is the plain wireformat over TLS. EDIT: so for DoH you would need to speak HTTP but for DNS over TLS you only need to wrap TLS around for example by using stunnel or something.
- CogitoCogito 7y ago
  Sorry if I'm dense, but that would mean that the two protocols _are_ the same except for port number for practical purposes right? I mean there's no reason why the same actions could be taken when running straight wireformat vs over http right? edit: In response to your edit :) So is the main objection to this that it breaks traditional layering then? E.g. here's a post in a thread that I found a bit helpful: https://old.reddit.com/r/privacy/comments/89pr15/dnsoverhttps_vs_dns_overtls_vs_dnscrypt/dwzk7g3/ https://old.reddit.com/r/privacy/comments/89pr15/dnsoverhttp... (The rest of the thread is interesting as well.) I guess one downside with DoH is that now there's a larger incentive to break through your https in general?
  - mercora 7y ago
    i was only responding to your question whether there is any difference between the two beside the port number used which there is, in a significant way. You can not point a DoH client to a DNS over TLS server or vice versa. That said there is no reason a DoH server could not be recursive or consult a traditional (probably recursive) resolver for its response. I think the only benefit of DoH is that is unlikely to be blocked. Otherwise it feels more like a hack and at least i am not concerned about OSI models ;) Actually, i tried to setup a DNS over TLS server some weeks ago but while it worked like intended i had a hard time to get reasonable response times even after somewhat serious fine tuning for the session setup (i used haproxy at server side). But this was mainly caused by the fact that systemd-resolved established a new connection for each and every request and i did not find a stub resolver that did not either.
    - CogitoCogito 7y ago
      > i was only responding to your question whether there is any difference between the two beside the port number used which there is, in a significant way. You can not point a DoH client to a DNS over TLS server or vice versa. That said there is no reason a DoH server could not be recursive or consult a traditional (probably recursive) resolver for its response. > I think the only benefit of DoH is that is unlikely to be blocked. Otherwise it feels more like a hack and at least i am not concerned about OSI models ;) Thanks for the response, but I'm still a little confused. If you live in the DoH stack you must stay there sure, but the same apparently applies to the DNS over TLS. What to you exactly is hacky about the DoH method if you don't care about the layering violations?