3 ms·
in my experience, it's not about the protocols, it's about all existing middleboxes blocking/intercepting all traffic on non 443 ports. UDP traffic is notorious
by iampims 7y ago
in my experience, it's not about the protocols, it's about all existing middleboxes blocking/intercepting all traffic on non 443 ports. UDP traffic is notoriously blocked by routers. The only viable option being: HTTPS.
- sundbry 7y agoProbably because in your corporate/controlled environment you're supposed to use the company DNS for a good reason.
- bluejekyll 7y agoIf you're not using a VPN, DNS is actually pretty easily spoofed. DoH and DoT make that much harder.
- defanor 7y ago> The only viable option being: HTTPS. But why not DoT on port 443? The story about office workers, sysadmins, and service providers trying to make life harder for each other and complicating things for everyone seems unfortunate, but makes sense, yet I don't quite see why HTTP has to be involved.
- bluejekyll 7y agoHTTP2 isn't significantly more overhead than TLS in my experience. Also, using DoT over 443 would mean that you have an issue with traffic not being distinguishable for routing purposes at the edge. By making DNS on 443 DoH, it means that all HTTP2 routers/loadbalancers/etc. can work the same regardless of it being a Web request or a DNS request, because then they are both Web, i.e. HTTP, requests.