4 ms·
DoT is easier for network admins to block. I prefer it, but that is a downside to DoT IMPO.
by _wldu 6y ago
DoT is easier for network admins to block. I prefer it, but that is a downside to DoT IMPO.
- syshum 6y agoas I network administrator, I prefer it for that reason :) DoH has caused several problems for enterprise networks and will likely continue to as I do not want nor desire my endpoints to be getting their DNS from CloudFlare, they need to use my servers that I configured at the network level I should not have to manage and apply group policies for every browser so DNS works like expected
- AnonHP 6y agoTheoretically, it’s true that DoT can be easily blocked by the network through port blocking and that blocking DoH is a lot more difficult because it’s over the same port (443) as web traffic. But in reality, the main browser makers embracing DoH have provided very easy mechanisms for network operators to tell browsers not to use DoH. So it’s not like DoH, at least as implemented by the main browsers, is against enterprises and network management.
- pgl 6y agoI don't really agree here. It's much harder to implement different mechanisms for each browser individually, and now that it's coming on the OS level (iOS 14, MacOS 11, Windows 10), there'll be a whole new set of ways to disable it. Firefox's canary domain method is a bit clunky but at least it can be set up at the DNS server level.
- dsr_ 6y agoI prefer DoT because I already supply DNS to all the machines in my network; I have a dozen upstream DoT resolvers that happily do the transcoding, and I still get to run internal domains.