Why is this a bad idea? You can't just say "it's bad" with no justification.
As a user, I can sure think of some countries with broken Internet access where this would come in handy.
I'll rephrase, it's way better accomplished with UDP without sacrificing security in the ways I list.
Running DNS over HTTPS over TCP isn't needed. It doesn't solve a problem.
Doing JSON DNS for OOB DNS checks is useful since most applications speak HTTP. :-)
Re:DNS-over-HTTPS
by sashametro on Friday September 30, 2016 @02:14PM
(#12614168)
Note that although it is not documented, when you query the Google DNS-over-HTTPS service from Chrome, it will usually use QUIC. You can check this at chrome://net-internals/#quic, and will probably see something like this (look DNS/HTTPS/QUIC/UDP/IPv6!):
dns.google.com:443 true QUIC_VERSION_34 [2607:f8b0:400d:c03::8a]:443 10544469510527000173 0 None 2 9 0 9 true
An independent implementation of QUIC (are there any outside of browsers?) would probably work much the same, modulo any changes during the ongoing standardization of QUIC.
Yup I threw together a toy too:
For debugging and diagnostics it is useful, for querying via a local resolver not so good.
This is a bad idea outside of experimentation. Not to be used for production.
If you want to secure DNS look at QUIC, TLS, or my favorite, DNSCrypt (which I funded).