3 ms·
DoT/DoH only stops one hop of the DNS resolution process from hijacking requests, so it isn't as good as DNSSEC for security. There is encrypted TLS handshakin
by pabs3 4y ago
DoT/DoH only stops one hop of the DNS resolution process from hijacking requests, so it isn't as good as DNSSEC for security.
There is encrypted TLS handshaking for hiding the TLS domain name indicator.
https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/
- duskwuff 4y ago> ... so it isn't as good as DNSSEC for security. And DNSSEC doesn't provide any privacy to the end user. Both mechanisms provide something of value, and ideally they'd both be used together.