8

Since both encrypt DNS queries, why are both DNS over TLS & DNS over HTTPS being developed? What does one offer that the other does not, if anything?

3

1 Answer 1

7

As the references for the wiki pages explain, the reason for having the DoH (DNS over HTTPS) protocol is to hide the fact that you are making a DNS query at all, thereby bypassing filters and DNS hijacking.

4
  • How can filters operate for DNS over TLS ? How can it be hijacked ? If that exist, then it is the same for DOH since HTTPS uses... TLS too! May 24, 2018 at 2:17
  • @PatrickMevzek DNS over TLS still uses port 53. A network provider can simply redirect the traffic since it is obvious what the traffic is without knowing the content of the traffic.
    – schroeder
    May 24, 2018 at 7:17
  • 2
    DNS over TLS is standardized on port 853 (see section 3.1 of tools.ietf.org/html/rfc7858) but that could be any other port too. The problem is more about broken middleboxes that filters things badly, not on malicious reasons, just sheer incompetences, hence HTTPS has more chance to go through. Same for captive portals and such. Sad state of affairs in my mind that we need to go to the lowest common denominator to have things go through, but this is another philosophical debate... May 24, 2018 at 13:26
  • With DoH it's impossible to filter out spyware and adware domains on my own router. For example SmartTVs and other wallet gardens don't allow running a privacy and ad filter. Sure DoH is Google best interest.
    – Josefine
    Apr 28, 2019 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.