Ohhhhhhhhhhhhh I wrote my reply assuming you meant DNS-over-TCP not DNS-over-TLS. Duh, sorry. Should have been obvious from context. Yeah DNS-over-TLS is safer

Ohhhhhhhhhhhhh I wrote my reply assuming you meant DNS-over-TCP not DNS-over-TLS. Duh, sorry. Should have been obvious from context. Yeah DNS-over-TLS is safer in this regard and provides equivalent network-path protection. DoH is kind of a garbage protocol but it's a concession to the fact that a lot of "real" networks are broken and HTTP(s) is the only thing you can rely on being able to transport. Since DNS-over-HTTPS goes over proxies and uses port 443, it'll "work by default" in a larger variety of networks than DNS-over-TLS. CloudFlare have made the argument that DoH "blends in" better with regular HTTPS traffic but I don't really buy that when everyone just uses the same few recursive resolvers.