13 ms·

Either way, as a network admin, DoT is easy to block -- you simply redirect all port 53 traffic to your own DNS. DoT will either fail, or fallback to plain text

Either way, as a network admin, DoT is easy to block -- you simply redirect all port 53 traffic to your own DNS. DoT will either fail, or fallback to plain text. Can't easily block all port 443 traffic (may as well not give any service), and as servers grow maintaining a blacklist of DoH would be problematic - especially when the DoH server is hidden behind normal sites on cloudflare etc. Of course a sysadmin can always establish a VPN on any port to any IP with TCP, UDP, ICMP, or even running a VPN over unencrypted DNS, and bypass all that network work other than very specific IP whitelisting. As a network admin and a sysadmin, I want to be able to control my systems from my network without losing control. I like the idea of DoH, I just don't want to have to reconfigure my DoH server everytime I want to connect to a split-brain network, or have an alternative PTR server, and I certainly don't want my browser using a different source for DNS to my other applications.

dijit 6y ago
I'm also a network/server admin. I don't see things as you do. Specialised protocols are better than generalised ones because they have understandable failure modes. If DNS goes down, name resolution fails. But if DoH goes down, it could still be DNS, it could be TLS Suites, it could be incorrect headers, it could be mishandling of the proxy (or the proxy forwarding garbage), it could be anything. that's why we consider DNS to be Layer 6 and not Layer 7, as things on Layer 7 may depend on it.
- iso1631 6y ago
  So DNS is easier to debug? So are many protocols. It doesn't mean we should still be using http, rlogin, or snmpv1. There are significant benefits to the end user of DoH in bypassing malicious networks. It's out there, it's not going away. I'd like it to integrate well in a situation where I am the user, sysadmin and netadmin.
  - dijit 6y ago
    rlogin -> ssh. unless you're saying we should replace SSH with HTTP. And yes, DNS is easier to debug than HTTP if HTTP depends on HTTP.
    - syshum 6y ago
      Well at this rate HTTP will simply eat all other things
    - iso1631 6y ago
      The problem is that DoT has almost all the drawbacks of DNS from ability to block (and thus fall back to non-TLS dns which can be manipulated), and almost all the drawbacks of DoH (harder to debug). It's the worst of both worlds.

dijit 6y ago

I'm also a network/server admin. I don't see things as you do. Specialised protocols are better than generalised ones because they have understandable failure modes. If DNS goes down, name resolution fails. But if DoH goes down, it could still be DNS, it could be TLS Suites, it could be incorrect headers, it could be mishandling of the proxy (or the proxy forwarding garbage), it could be anything. that's why we consider DNS to be Layer 6 and not Layer 7, as things on Layer 7 may depend on it.

iso1631 6y ago
So DNS is easier to debug? So are many protocols. It doesn't mean we should still be using http, rlogin, or snmpv1. There are significant benefits to the end user of DoH in bypassing malicious networks. It's out there, it's not going away. I'd like it to integrate well in a situation where I am the user, sysadmin and netadmin.
- dijit 6y ago
  rlogin -> ssh. unless you're saying we should replace SSH with HTTP. And yes, DNS is easier to debug than HTTP if HTTP depends on HTTP.
  - syshum 6y ago
    Well at this rate HTTP will simply eat all other things
  - iso1631 6y ago
    The problem is that DoT has almost all the drawbacks of DNS from ability to block (and thus fall back to non-TLS dns which can be manipulated), and almost all the drawbacks of DoH (harder to debug). It's the worst of both worlds.