8

Since both encrypt DNS queries, why are both DNS over TLS & DNS over HTTPS being developed? What does one offer that the other does not, if anything?

7

As the references for the wiki pages explain, the reason for having the DoH (DNS over HTTPS) protocol is to hide the fact that you are making a DNS query at all, thereby bypassing filters and DNS hijacking.

| improve this answer | |
  • How can filters operate for DNS over TLS ? How can it be hijacked ? If that exist, then it is the same for DOH since HTTPS uses... TLS too! – Patrick Mevzek May 24 '18 at 2:17
  • @PatrickMevzek DNS over TLS still uses port 53. A network provider can simply redirect the traffic since it is obvious what the traffic is without knowing the content of the traffic. – schroeder May 24 '18 at 7:17
  • 2
    DNS over TLS is standardized on port 853 (see section 3.1 of tools.ietf.org/html/rfc7858) but that could be any other port too. The problem is more about broken middleboxes that filters things badly, not on malicious reasons, just sheer incompetences, hence HTTPS has more chance to go through. Same for captive portals and such. Sad state of affairs in my mind that we need to go to the lowest common denominator to have things go through, but this is another philosophical debate... – Patrick Mevzek May 24 '18 at 13:26
  • With DoH it's impossible to filter out spyware and adware domains on my own router. For example SmartTVs and other wallet gardens don't allow running a privacy and ad filter. Sure DoH is Google best interest. – Ivanov Apr 28 '19 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.