Re:A cartoon intro to DNS over HTTPS (2018)
by tptacek on Sunday October 20, 2019 @11:15AM
(#21304650)
DNSSEC doesn't provide privacy at all; it signs records, but doesn't encrypt queries or responses. So it's orthogonal to the DoH debate.
DoT does essentially the same thing that DoH does. The difference between DoT and DoH, from a practical perspective, is that DoT uses a new TCP port, and DoH overloads 443. The reason DoH overloads 443 is to make it difficult for network operators to disable. In other words: DoT is simply DoH with a network-controlled kill switch.
How exactly is DoT "more comprehensive" (to use the words from the tweet you've cited) than DoH?
DoT does essentially the same thing that DoH does. The difference between DoT and DoH, from a practical perspective, is that DoT uses a new TCP port, and DoH overloads 443. The reason DoH overloads 443 is to make it difficult for network operators to disable. In other words: DoT is simply DoH with a network-controlled kill switch.
How exactly is DoT "more comprehensive" (to use the words from the tweet you've cited) than DoH?