3 ms·

Good reddit thread discussing the differences between the following (I googled it specifically to find out what practical differences existed between DNS over T

Good reddit thread discussing the differences between the following (I googled it specifically to find out what practical differences existed between DNS over TLS and DNSCrypt): * DNS over HTTPS (DoH) * DNS over TLS (DoT) * DNSCrypt https://www.reddit.com/r/privacy/comments/89pr15/dnsoverhttps_vs_dns_overtls_vs_dnscrypt/ https://www.reddit.com/r/privacy/comments/89pr15/dnsoverhttp... TL;DR: It looks like DoT probably achieves much the same thing but may have more support through standardized implementations at least compared to DNSCrypt. I disregarded the top comment's opinion about DoH since their position is likely influenced by their state of competition with Cloudflare.

yegle 7y ago
Most of the top comments in the thread are 1 years old now. DoH back then I think only have a Google DNS flavor which send request as human readable POST data or query string and respond in JSON. Since then the DoH has been standardized under RFC 8484 (not final yet) and switched to use DNS wire format. DoT may have wider support right now due to 1) Android P have built-in support, and 2) Debian 10 uses subby as local DNS cache which send upstream request over DoT. But I think DoH is catching up since Firefox and now Chrome are going to support it. I would assume Apple and Microsoft would follow along and add the DoH support to their browsers.
- dngray 7y ago
  > But I think DoH is catching up since Firefox and now Chrome are going to support it. I would assume Apple and Microsoft would follow along and add the DoH support to their browsers. I think DoHs will end up being the standard that 'wins' as such because DoT can be banned by governments who do not want you doing it. In addition to that I can see at some point DoHs becoming DNS over QUIC. It seems as if QUIC is now a part of HTTP/3 so that's quite likely. When the standards finalize: • https://datatracker.ietf.org/doc/draft-ietf-quic-transport/ https://datatracker.ietf.org/doc/draft-ietf-quic-transport/ • https://datatracker.ietf.org/doc/draft-huitema-quic-dnsoquic/ https://datatracker.ietf.org/doc/draft-huitema-quic-dnsoquic... What is interesting is DNSCrypt https://dnscrypt.info/faq https://dnscrypt.info/faq also acknowledge that fact under the section for DoHS: "Will automatically benefit from improvements made to HTTP/2 and, eventually, QUIC"
gsich 7y ago
He is right though. The NAT comparison is apt.

yegle 7y ago

Most of the top comments in the thread are 1 years old now. DoH back then I think only have a Google DNS flavor which send request as human readable POST data or query string and respond in JSON. Since then the DoH has been standardized under RFC 8484 (not final yet) and switched to use DNS wire format. DoT may have wider support right now due to 1) Android P have built-in support, and 2) Debian 10 uses subby as local DNS cache which send upstream request over DoT. But I think DoH is catching up since Firefox and now Chrome are going to support it. I would assume Apple and Microsoft would follow along and add the DoH support to their browsers.

dngray 7y ago
> But I think DoH is catching up since Firefox and now Chrome are going to support it. I would assume Apple and Microsoft would follow along and add the DoH support to their browsers. I think DoHs will end up being the standard that 'wins' as such because DoT can be banned by governments who do not want you doing it. In addition to that I can see at some point DoHs becoming DNS over QUIC. It seems as if QUIC is now a part of HTTP/3 so that's quite likely. When the standards finalize: • https://datatracker.ietf.org/doc/draft-ietf-quic-transport/ https://datatracker.ietf.org/doc/draft-ietf-quic-transport/ • https://datatracker.ietf.org/doc/draft-huitema-quic-dnsoquic/ https://datatracker.ietf.org/doc/draft-huitema-quic-dnsoquic... What is interesting is DNSCrypt https://dnscrypt.info/faq https://dnscrypt.info/faq also acknowledge that fact under the section for DoHS: "Will automatically benefit from improvements made to HTTP/2 and, eventually, QUIC"

gsich 7y ago

He is right though. The NAT comparison is apt.