6 ms·

Why has the world gone towards DNS over HTTPS as opposed to adding TLS itself to the DNS protocol?

cosmojg 6y ago
DNS over TLS (DoT) already exists, and it's apparently both faster and more efficient. The argument I've heard for preferring DoH is the fact that it disguises DNS traffic, making it indistinguishable from other HTTPS traffic.
- deleted 6y ago
  [deleted]
egyptiankarim 6y ago
I think the arguments are that there's a degree of security through obfuscation by forcing everything over a single common port (443), the transmission integrity benefits of TCP versus UDP protocols, and maybe just the overall simplicity of HTTPS as a protocol.
AnonC 6y ago
There’s DoT (DNS Over TLS), which operates on port 853, uses TCP and provides encryption. But it’s also something network operators can easily block since it runs on a specific, separate port. DNS over HTTPS (DoH), on the other hand, rides on HTTPS/port 443, which cannot be blocked in networks without causing major disruptions to the rest of the web traffic. A more detailed comparison is here: https://www.thesslstore.com/blog/dns-over-tls-vs-dns-over-https/ https://www.thesslstore.com/blog/dns-over-tls-vs-dns-over-ht...
- dsl 6y ago
  You can run DoT on 443 as well. Providers that want to block DoH or DoT are going to block providers based on destination IP or certificate fingerprints, not port numbers.
  - middleclick 6y ago
    Providers are hesitant to block IP addresses for a multitude of reasons, one of the simplest ones being that different services can run on a single IP. And running DoT on a non-standard port breaks all sorts of things because it will be ... non-standard.
- m3047 6y ago
  > DNS over HTTPS (DoH), on the other hand, rides on HTTPS/port 443, which cannot be blocked in networks without causing major disruptions... And your point is what, exactly? TLS allows for traffic redirection and for a time people were using this to circumvent firewalls but the big providers who looked the other way locked it down when their traffic started being blocked.
- the8472 6y ago
  That kind of reasoning reinforces the existing problem instead of breaking things up by making support for arbitrary ports essential.
- corford 6y ago
  If there was a coordinated embrace and move to DoT (at least for the "last mile" part between end users and resolvers), network operators wouldn't be able to get away with blocking it (see secure IMAP, secure POP etc. for similar shifts in the past).
  - sneak 6y ago
    The internet is decentralized and "coordinated embrace" is not realistic or practical. See also: IPv6. Pretty much the whole of the internet has been jammed into tcp/443 now, and it can't much be helped. Internet engineering needs to cope with the world as it is, not how we wish it were.
    - corford 6y ago
      >The internet is decentralized and "coordinated embrace" is not realistic or practical. I disagree, see the success of: letsencrypt, the wide spread use of 8.8.8.8 and 1.1.1.1; dkim/spf/dmarc; imaps, pop3s, tls ldap. Why should a switch over to DoT be any different? If anything it should be easier. The general need for better security and privacy are much more widely understood and accepted concerns these days.
  - tptacek 6y ago
    The opposite is true: most DoT advocacy comes from operators (and suppliers to those operators) who specifically and overtly intend to filter DNS.
    - LogicX 6y ago
      As said DNS operator (founder and CTO of DNSFilter.com) - I concur. We’ve been offering DoT for years, but are about to improve the offering with 0-RTT support. We’re also working on POCs of DoH support, but it’s mostly moot compared to our DoT offerings which cover the whole OS, not just the browser.
      - tptacek 6y ago
floatingatoll 6y ago
If everything is encrypted over the wire in an HTTPS wrapper, then crappy internet providers can’t discriminate against your traffic based on its nature.
tptacek 6y ago
There is DNS-over-TLS. The difference between DoH and DoT is that DoT runs over a distinct port, and can be trivially filtered by network operators. DoH was created specifically to run encrypted DNS over a transport that would require more intensive filtering to block. As an anti-censorship mechanism, it's imperfect, but it comes at little real cost (other than preventing operators from blocking encrypted DNS, which is the point). DoT is, effectively, DoH with a kill switch. It'e essentially a moot point at this point; DoH won.
- eatbitseveryday 6y ago
  Hm, why not add an encryption-upgrade path to the protocol using the same port? Why must we use another port?
  - pas 6y ago
    Again, trivially easy to block that. But DoH is real HTTP(S), you cannot really distinguish it from a HTTPS request for wikipedia.org or outlook.com. The SNI hole is slowly being addressed by ESNI - https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/

DNS over TLS (DoT) already exists, and it's apparently both faster and more efficient. The argument I've heard for preferring DoH is the fact that it disguises DNS traffic, making it indistinguishable from other HTTPS traffic.

deleted 6y ago
[deleted]

egyptiankarim 6y ago

I think the arguments are that there's a degree of security through obfuscation by forcing everything over a single common port (443), the transmission integrity benefits of TCP versus UDP protocols, and maybe just the overall simplicity of HTTPS as a protocol.

AnonC 6y ago

There’s DoT (DNS Over TLS), which operates on port 853, uses TCP and provides encryption. But it’s also something network operators can easily block since it runs on a specific, separate port. DNS over HTTPS (DoH), on the other hand, rides on HTTPS/port 443, which cannot be blocked in networks without causing major disruptions to the rest of the web traffic. A more detailed comparison is here: https://www.thesslstore.com/blog/dns-over-tls-vs-dns-over-https/ https://www.thesslstore.com/blog/dns-over-tls-vs-dns-over-ht...

dsl 6y ago
You can run DoT on 443 as well. Providers that want to block DoH or DoT are going to block providers based on destination IP or certificate fingerprints, not port numbers.
- middleclick 6y ago
  Providers are hesitant to block IP addresses for a multitude of reasons, one of the simplest ones being that different services can run on a single IP. And running DoT on a non-standard port breaks all sorts of things because it will be ... non-standard.
m3047 6y ago
> DNS over HTTPS (DoH), on the other hand, rides on HTTPS/port 443, which cannot be blocked in networks without causing major disruptions... And your point is what, exactly? TLS allows for traffic redirection and for a time people were using this to circumvent firewalls but the big providers who looked the other way locked it down when their traffic started being blocked.
the8472 6y ago
That kind of reasoning reinforces the existing problem instead of breaking things up by making support for arbitrary ports essential.
corford 6y ago
If there was a coordinated embrace and move to DoT (at least for the "last mile" part between end users and resolvers), network operators wouldn't be able to get away with blocking it (see secure IMAP, secure POP etc. for similar shifts in the past).
- sneak 6y ago
  The internet is decentralized and "coordinated embrace" is not realistic or practical. See also: IPv6. Pretty much the whole of the internet has been jammed into tcp/443 now, and it can't much be helped. Internet engineering needs to cope with the world as it is, not how we wish it were.
  - corford 6y ago
    >The internet is decentralized and "coordinated embrace" is not realistic or practical. I disagree, see the success of: letsencrypt, the wide spread use of 8.8.8.8 and 1.1.1.1; dkim/spf/dmarc; imaps, pop3s, tls ldap. Why should a switch over to DoT be any different? If anything it should be easier. The general need for better security and privacy are much more widely understood and accepted concerns these days.
- tptacek 6y ago
  The opposite is true: most DoT advocacy comes from operators (and suppliers to those operators) who specifically and overtly intend to filter DNS.
  - LogicX 6y ago
    As said DNS operator (founder and CTO of DNSFilter.com) - I concur. We’ve been offering DoT for years, but are about to improve the offering with 0-RTT support. We’re also working on POCs of DoH support, but it’s mostly moot compared to our DoT offerings which cover the whole OS, not just the browser.
    - tptacek 6y ago

floatingatoll 6y ago

If everything is encrypted over the wire in an HTTPS wrapper, then crappy internet providers can’t discriminate against your traffic based on its nature.

tptacek 6y ago

There is DNS-over-TLS. The difference between DoH and DoT is that DoT runs over a distinct port, and can be trivially filtered by network operators. DoH was created specifically to run encrypted DNS over a transport that would require more intensive filtering to block. As an anti-censorship mechanism, it's imperfect, but it comes at little real cost (other than preventing operators from blocking encrypted DNS, which is the point). DoT is, effectively, DoH with a kill switch. It'e essentially a moot point at this point; DoH won.

eatbitseveryday 6y ago
Hm, why not add an encryption-upgrade path to the protocol using the same port? Why must we use another port?
- pas 6y ago
  Again, trivially easy to block that. But DoH is real HTTP(S), you cannot really distinguish it from a HTTPS request for wikipedia.org or outlook.com. The SNI hole is slowly being addressed by ESNI - https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/