3 ms·
i'm wondering how does it compare to CurveDNS. once the root nameservers (or at least the TLD NSes) support curvedns, the ISPs won't see what the users query or
by bandie91 5y ago
i'm wondering how does it compare to CurveDNS.
once the root nameservers (or at least the TLD NSes) support curvedns, the ISPs won't see what the users query or the dns answer, only the IPs of the NSes the users queries.
it maybe give some insight for ISPs to know approximately which domain names users look up, but "big corp" ODNS and DOH provides won't get this info. and eventhough, ISPs still have a better resolution on what sites the user visits based on bare IP traffic (see https://blog.apnic.net/2019/08/23/what-can-you-learn-from-an-ip-address/ https://blog.apnic.net/2019/08/23/what-can-you-learn-from-an... ).
IMO to minimize even that info that which NS IPs users query, zone and NS admins should cooperate to have as many secondary NS per zone as possible, even at 3rd party NS providers AND sign zones by DNS-SEC to prevent tampering at 3rd party NSes. in this ways the zone–to–nameserver-ip mapping becomes a many–to–many relation which ISPs can not rely on.