Easier to make the orgs internal recursive resolver "does the right thing" than all clients, too.

Replace "enterprise" with "ISP" or "nation state", and that's closer to what the DoH aims are.

DOH will cause so much drama when internal sites wont resolve any more.

Now you could argue that the fault in both of those cases is IPv4 and the natting that comes with it.

But yes. If u have a domain that is supposed to resolve different depending on the source ip that'd be..interesting... Now u need a website that displays different content depending on source ip or something like that...

One issue with doh is that it’s inconsistent - some applications use one resolver, some use another. The network (via dhcp) can’t hint at which resolver to use.

I have over 200 domains internally, that i don't have externally.

but its also flexibility. We often when we develop, want to redirect certain domains to our endpoints, for testing or whatever, and do that on DNS so that not everyone has to edit host files etc.

we have pfsense internally, with number of people that can and do add/remove hosts/domains on daily basis, but host our external DNS on CF, and only 2 people have access to that.