How do you know the network you're connected to isn't intercepting DNS requests and returning whatever it wants?

Set your OS to use your DOH server of choice.

Personally when my laptop is connected to a network on a high latency link to the internet, I'd rather it used the local caching server rather than one half a continent away. Clearly if I don't trust that network provided DNS server I'll tunnel everything out to a trusted network, or I could specify a DOH.

I have no practical issue with DOH if it were implemented at the OS level and had standards around how to distribute recommended settings (just like my dhcp server distributes a recommended gateway, recommended ntp server, recommended tftp boot server, etc).

Use DNSSEC.

DNSSEC doesn't do that at all. DNSSEC does no transaction encryption. It allows full recursive resolvers --- the kind virtually nobody runs on their own machines --- to validate signatures on the tiny minority of domains (virtually none of them among the most popular on the Internet) that have opted in to DNSSEC over the last 10 years. Note that even in the unusual corner case where you're looking up a name that's actually signed with a DNS recursor that actually verifies DNSSEC signatures, the network between you can still snoop on all your DNS requests, because DNSSEC is bad.

If you're worried that your network upstream is intercepting your DNS requests (and if you're in the US on a mainstream ISP, you should be), this is the problem DoH is designed to solve, and it does so quite effectively.

DoH does not solve the problem that the resolver can just feed you wrong data. So if you want integrity for your DNS records you need DNSSEC. DoH/DoT does not solve that.

DoH deliberately doesn't touch that problem. In 25 years of work, DNSSEC hasn't put a dent in it --- look at the stats on which zones are signed (and note that most of those signatures are security theater, done automatically by registrars).

The fact is that there's nothing you can do to authenticate DNS records, and turning some silly "DNSSEC" feature on in your own stack won't do anything but make you feel better, because DNSSEC simply doesn't have meaningful adoption. However, enabling DoH does in fact immediately protect you from attacks that really do happen, like ISPs monetizing your DNS.

>DoH deliberately doesn't touch that problem.

Exactly. That's what I said.

The problem is that DoH is not the solution, as you just change trust from resolver A to resolver B. With no indication that B is better than A.

If you fear that your ISP is selling your data you need to change your ISP. The ISP always know what sites you are accessing, regardless of DNS. DNS might be easier than SNI or IP lookups but the danger is still the same. Right now it might actually help but once encrypted DNS gets enough traction those methods will also adapt. (Assuming that ISPs still do that practice)

It's funny that you've managed simultaneously to argue that DNS monetization (which is ubiquitous) is both a reason to immediately change ISPs, and also not a big deal because ISPs can snoop on you anyways.

While I have strong normative beliefs here, I'm mostly just posting descriptively. DNSSEC isn't happening. Enabling DNSSEC in your local configuration won't meaningfully protect you, because you depend on the security teams of large companies to also participate in the system, and DNSSEC has been more or less rejected by the market. Meanwhile: there are specific problems that DoH does protect against, it's easy to roll out, and doesn't depend on the Stripe security team changing their mind about DNSSEC --- so DoH is on a path to become universal, even as DNSSEC whithers.

(I invite the curious to test my reporting out with the `host -t ds foo.com` command, for arbitrary values of "foo").

I know I sound like a sore winner about this, and I guess I sort of am, but it is a little alarming that there are still currents of sysadmin wisdom telling people to go out of their way to opt into DNSSEC, in the belief that it will somehow protect them from any kind of real attack. In reality: corrupted DNS records overwhelmingly come from phished registrar accounts, not the elaborate, geographically-specific DNS cache corruption attacks DNSSEC was envisaged to deal with. I think it's worth being plain with people about this stuff.

>It's funny that you've managed simultaneously to argue that DNS monetization (which is ubiquitous) is both a reason to immediately change ISPs, and also not a big deal because ISPs can snoop on you anyways.

Of course. If you know that your ISP is doing that, you change to one that is not doing it. It's not ubiquitous. Besides that, what makes you think that your DoH provider (if not your ISP) is also not selling that data?

You think that DoH/DoT is somewhat a replacement for DNSSEC but it's not. Both are independent. Doesn't matter how much domains have it.

How do I know if my ISP is doing that? And which ISP do I change to? Where I live, there’s effectively a single available ISP unless I don’t mind dropping down to single digit mbps.

Seems more plausible to just run DoH for my DNS and then not worry about my ISP snooping on my DNS requests.

DOH to your trusted resolver which you run yourself (which uses DNSSec upstream)

Shame that I have 20 applications on several different users on two dozen different machines to configure