6 ms·

Another point not mentioned in the article is that encrypted DNS (be it DoH or DoT) requires significantly more resources to run a public recursive resolver. Yo

Another point not mentioned in the article is that encrypted DNS (be it DoH or DoT) requires significantly more resources to run a public recursive resolver. You have to either monetize it somehow or fund it with money from your other business. So it means more centralization and less neutrality.

bluejekyll 7y ago
> requires significantly more resources to run a public recursive resolver. Do you know of any studies or released cost breakdowns that show this? Depending on your view, DNSSEC might be considered to be operationally more costly. But also modern equipment is pretty good at this task.
- ComodoHacker 7y ago
  Not for еDNS, but I've seen such reports about HTTPS when it was in the process of wide adoption. In case of DNS, not only more CPU is consumed on encryption, but more memory too, since it's stateful. And all this both with client and upstream.
seanhunter 7y ago
Why do you say that it requires significantly more resources? Running a public recursive resolver has never been something to take lightly - keeping your resolver immune to DDoS, cache poisoning, general security bugs (depending on which DNS server software you run) etc has always been a major undertaking.
karasu 7y ago
Isn't this a really odd point? Right now, you can hardly run a public resolver in the traditional sense as UDP resolvers are prone to be used for DNS amplification attacks and TCP isn't supported/configurable on all clients. On the other hand, running a DoH or DoT resolver is no more ressource intentive than, say, hosting your own website and even Android allows you to set a DoT resolver nowadays.
jstanley 7y ago
A friend of mine runs a public DoH server at https://doh.li/ https://doh.li/, and is "currently handling ~220k req/day with a $10/mo DO instance, no optimisation at all, CPU load is at 20%" so I don't think running a public resolver is at all beyond the reach of a hobbyist.
- labawi 7y ago
  Well, checking my resolver statistics from a random day, it clocked about 8000 queries. Discounting some for mail, it leaves 7+k from my own browsing. That would estimate your friend's public resolver at serving about 20 users, though I guess could be anywhere between 1 and 300.
throw0101a 7y ago
> .. encrypted DNS (be it DoH or DoT) requires significantly more resources ... See also last week's NANOG 77 talk "Analyzing the Costs (and Benefits) of DNS, DoT, and DoH for the Modern Web" (7h20m20s): * https://www.youtube.com/watch?v=9JSG7RS8imk&t=7h20m20s https://www.youtube.com/watch?v=9JSG7RS8imk&t=7h20m20s It focuses on the end-user impact / experience. Encrypted DNS can actually be as fast, if not faster at times, as plain DNS ("Do53") under certain conditions. Once a TCP/TLS session is setup, it can be kept up: you don't have to tear it down every time.

bluejekyll 7y ago

> requires significantly more resources to run a public recursive resolver. Do you know of any studies or released cost breakdowns that show this? Depending on your view, DNSSEC might be considered to be operationally more costly. But also modern equipment is pretty good at this task.

ComodoHacker 7y ago
Not for еDNS, but I've seen such reports about HTTPS when it was in the process of wide adoption. In case of DNS, not only more CPU is consumed on encryption, but more memory too, since it's stateful. And all this both with client and upstream.

seanhunter 7y ago

Why do you say that it requires significantly more resources? Running a public recursive resolver has never been something to take lightly - keeping your resolver immune to DDoS, cache poisoning, general security bugs (depending on which DNS server software you run) etc has always been a major undertaking.

karasu 7y ago

Isn't this a really odd point? Right now, you can hardly run a public resolver in the traditional sense as UDP resolvers are prone to be used for DNS amplification attacks and TCP isn't supported/configurable on all clients. On the other hand, running a DoH or DoT resolver is no more ressource intentive than, say, hosting your own website and even Android allows you to set a DoT resolver nowadays.

jstanley 7y ago

A friend of mine runs a public DoH server at https://doh.li/ https://doh.li/, and is "currently handling ~220k req/day with a $10/mo DO instance, no optimisation at all, CPU load is at 20%" so I don't think running a public resolver is at all beyond the reach of a hobbyist.

labawi 7y ago
Well, checking my resolver statistics from a random day, it clocked about 8000 queries. Discounting some for mail, it leaves 7+k from my own browsing. That would estimate your friend's public resolver at serving about 20 users, though I guess could be anywhere between 1 and 300.

throw0101a 7y ago

> .. encrypted DNS (be it DoH or DoT) requires significantly more resources ... See also last week's NANOG 77 talk "Analyzing the Costs (and Benefits) of DNS, DoT, and DoH for the Modern Web" (7h20m20s): * https://www.youtube.com/watch?v=9JSG7RS8imk&t=7h20m20s https://www.youtube.com/watch?v=9JSG7RS8imk&t=7h20m20s It focuses on the end-user impact / experience. Encrypted DNS can actually be as fast, if not faster at times, as plain DNS ("Do53") under certain conditions. Once a TCP/TLS session is setup, it can be kept up: you don't have to tear it down every time.