3 ms·
I thought one of the benefits of DoH over DoT was that in the case where an adversary (e.g. a state with Internet censorship) is trying to block DNS access, it'
by remexre 4y ago
I thought one of the benefits of DoH over DoT was that in the case where an adversary (e.g. a state with Internet censorship) is trying to block DNS access, it's not distinguishable from a normal HTTPS connection, which you can't block willy-nilly without breaking most of the internet.
- ignoramous 4y agoYes. And pretty much anyone can run a personal DoH stub resolver for ~$0: https://github.com/serverless-dns/zero https://github.com/serverless-dns/zero
- jeroenhd 4y agoThe connection itself can be hard to block, but with public DNS resolvers still using dedicated IP addresses I don't think this is as effective as intended. Just DoH won't save you from an oppressive government and neither will DoT. You can run DoT on port 443 and it'll appear as normal TLS traffic as well. Unless the state actors are doing extensive fingerprinting (that will expose DoH servers as well) I doubt it'll make a difference in situations where DoH makes sense. In areas where occasional government TLS MitM attacks are common, neither DoH nor DoT will protect you.