Re:Shutting down our unencrypted public DNS service
by remexre on Tuesday December 13, 2022 @09:06PM
(#33979126)
I thought one of the benefits of DoH over DoT was that in the case where an adversary (e.g. a state with Internet censorship) is trying to block DNS access, it's not distinguishable from a normal HTTPS connection, which you can't block willy-nilly without breaking most of the internet.
[ Parent
| on HN ]
Re:Shutting down our unencrypted public DNS service
by ignoramous on Wednesday December 14, 2022 @12:47PM
(#33986975)
Yes.
And pretty much anyone can run a personal DoH stub resolver for ~$0: https://github.com/serverless-dns/zero
Re:Shutting down our unencrypted public DNS service
by jeroenhd on Thursday December 15, 2022 @05:01AM
(#33997384)
The connection itself can be hard to block, but with public DNS resolvers still using dedicated IP addresses I don't think this is as effective as intended.
Just DoH won't save you from an oppressive government and neither will DoT. You can run DoT on port 443 and it'll appear as normal TLS traffic as well. Unless the state actors are doing extensive fingerprinting (that will expose DoH servers as well) I doubt it'll make a difference in situations where DoH makes sense. In areas where occasional government TLS MitM attacks are common, neither DoH nor DoT will protect you.