8

Since both encrypt DNS queries, why are both DNS over TLS & DNS over HTTPS being developed? What does one offer that the other does not, if anything?

3

1 Answer 1

7

As the references for the wiki pages explain, the reason for having the DoH (DNS over HTTPS) protocol is to hide the fact that you are making a DNS query at all, thereby bypassing filters and DNS hijacking.

4
  • How can filters operate for DNS over TLS ? How can it be hijacked ? If that exist, then it is the same for DOH since HTTPS uses... TLS too! Commented May 24, 2018 at 2:17
  • @PatrickMevzek DNS over TLS still uses port 53. A network provider can simply redirect the traffic since it is obvious what the traffic is without knowing the content of the traffic.
    – schroeder
    Commented May 24, 2018 at 7:17
  • 2
    DNS over TLS is standardized on port 853 (see section 3.1 of tools.ietf.org/html/rfc7858) but that could be any other port too. The problem is more about broken middleboxes that filters things badly, not on malicious reasons, just sheer incompetences, hence HTTPS has more chance to go through. Same for captive portals and such. Sad state of affairs in my mind that we need to go to the lowest common denominator to have things go through, but this is another philosophical debate... Commented May 24, 2018 at 13:26
  • With DoH it's impossible to filter out spyware and adware domains on my own router. For example SmartTVs and other wallet gardens don't allow running a privacy and ad filter. Sure DoH is Google best interest.
    – Sybil
    Commented Apr 28, 2019 at 15:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .