4 ms·
> The fact that no mainstream consumer OS runs a local recursive resolver should be a clear signal to you that people disagree with you about this; in particula
by zrm 7y ago
> The fact that no mainstream consumer OS runs a local recursive resolver should be a clear signal to you that people disagree with you about this; in particular, because doing so eliminates DNS caching, which is something most people want.
Doesn't DoH eliminate caching as well? It means all your queries go out to some server on the internet with perhaps 20-50ms of latency, instead of a local cache potentially on your LAN with <1ms. A DNS cache on the LAN would also merge queries from multiple devices, concealing which device is making the query and in many cases preventing the query from having to be sent over the internet at all.
The best thing might be to have internet gateways run a DNS stub that itself makes queries via DoH/DoT/whatever and then caches them for every device on the LAN. The gateway is typically the DHCP server so it can hand itself out as the DNS and requires no configuration as well. And then it works across all devices and applications.
- deleted 7y ago[deleted]
- pvg 7y agoDoesn't DoH eliminate caching as well? Why would it eliminate caching? If you resolve over DoH you can still cache. It's not like turning DoH on in FireFox forces it to stop caching.
- zrm 7y agoIn that sense neither would putting a recursive resolver in your OS. DNS can have arbitrarily many levels of caching, because stub resolvers can be caches and can point to other stub resolvers. For example, you might have a DNS cache in your OS so that if more than one process asks to resolve the same name (or the same process asks more than once because it doesn't have internal caching), only one query has to be made. That resolver may point to a DNS cache on your LAN (deduplicating queries between devices), which in turn may point to a recursive resolver on the internet, which may itself be caching data from the authoritative servers. If you replace that with DoH between the application and the recursive resolver on the internet, all the intermediary caches are eliminated, even though they might have had significantly lower response times than the resolver on the internet.
- pvg 7y agoI'm not quite following all of this but before I try to sort it out in detail, is the fundamental objection here 'a DOH-using app is not using the OS resolver'?
- zrm 7y agoThat is effectively what causes the issue. The local resolver in the OS or on the LAN may have the name cached (because some other application or device requested it previously) and is thereby able to respond in <1ms, but if the application doesn't use them it has to take a round trip to the internet.
- pvg 7y agoAh I see. I don't find it particularly convincing as a thing leveled at DoH specifically because apps have been doing this for years. Browsers, Electron apps, Unity apps, whatnot. All have lived happy and successful lives without lookup latencies or the internet-as-we-know-it suffering any obvious ill effects. It's not a meaningful critique of DoH because we know the problems the critique warns of haven't really been problems.
- zrm 7y agoYou're naming some things that have notoriously bad performance. Being slow doesn't guarantee failure but it sure isn't a feature. And the problem isn't the protocol here, it's the choice of resolver. If the resolver on your LAN made queries using DoH instead of the application itself then your ISP still couldn't read them, but you would regain the benefits of local caching.
- pvg 7y agoThey don't have 'notoriously bad performance' because of DNS or lack of some sort of global DNS caching. That just isn't the case. Firefox also didn't honour systemwide proxy settings for a decade+, nobody really cared because it fundamentally didn't matter. If the DNS thing was that important, somebody would have complained about it before. Nobody (statistically) ever did, any more than they did about the proxy thing.