3 ms·
You can run DoT on any port, including 443. Then blocking it gonna be the same as blocking DoH. Why wrap it into HTTP request layer?
by YeBanKo 3y ago
You can run DoT on any port, including 443. Then blocking it gonna be the same as blocking DoH. Why wrap it into HTTP request layer?
- d-z-m 3y agoDoH makes the request look like a regular HTTPS request, therefore you'd need more sophisticated heuristics to block it. If you contend that you can match the DoH SNI with a known DoH server and block that, fair enough. However, there's always another unknown DoH server you haven't blocked. Blocking DoT is trivial in comparison, because of its signature on the wire.