DNS encryption is going to be one of the big boondoggles of the 21st century internet. I am currently going through a project at work to certify all the applic

DNS encryption is going to be one of the big boondoggles of the 21st century internet. I am currently going through a project at work to certify all the applications which need a custom root CA cert added to them, for their traffic to be inspected. This is part of GDPR certification. This is not some nefarious project to spy on employees, or even a DLP initiative. To comply with GDPR, we have to know where PII comes and goes, and over 80% of that data goes over HTTPS. That means that for any company to be able to comply with GDPR, they have to inspect all HTTPS traffic. Now, could TLS clients provide a mechanism to export all decrypted traffic, separate from the validation path? Sure. But that's not a part of the TLS spec, so to my knowledge, TLS libraries just don't have that option, and all the applications I know of certainly don't expose it. So even though to provide for the above requirements, all we need is a read-only tap of the decrypted content, it wasn't required (or possibly even considered), so now we need read-write access to all content, which is in no way what the requirements were intended for. That's bad, but what's worse is this process is introducing dozens of bugs. In many cases, the proprietary content filters are actually failing to validate correctly, and proxying payloads from hosts with invalid certs to unsuspecting clients. Not only do we have to MITM everything, but we're making security worse, and breaking apps. Take all of these considerations, and now instead of it being HTTP content, it's DNS. From an internet privacy perspective, there are only so many hostnames and IPs on the internet. Regardless of how you encrypt it, if you can observe hundreds of millions of individual users' traffic, it will be trivial to discover what DNS records a connection is requesting by statistical analysis. I agree with making the data integrity immutable, but that doesn't mean we have to force it all to also be private, not to mention breaking the distributed, decentralized design that made DNS resilient to begin with.