2

I'm currently studying the new technologies: DNS-over-https (DoH) and DNS-over-TLS (DoT). I already read the RFC for both of this technologies.

To test DoH, I'm working with Firefox (nigthly build). I setup the good DNS server (the one from Cloudfare) and when I look in wireshark for HTTPS requests there is nothing.

But, if I look under SSL, there is some DoT requests. The interresting fact is that these requests are using the DNS of Cloudfare so I was thinking that was what I was looking for. Is that really my DoH requests?

Can anyone explain me the difference between those two? Or give me a hint?

Improve this question
6
  • 1
    I'm not sure what you are asking. Do you want to know the difference between DoH and DoT as the title implies or do you want to know how to interpret what you see (but not show) in Wireshark? Please adjust either your title or your question accordingly and in the last case provide the relevant part of the pcap so that one can reproduce what you are talking about. In case you are not sure yet what you see: DoH uses port 443 like HTTPS and DoT uses port 853. And both are some application data wrapped into TLS so they look similar from outside.
    – Steffen Ullrich
    Commented Oct 25, 2018 at 7:41
  • My question: I made a request with DoH but I only see DoT requests. Are they my requests? And if so, what is the difference between DoH and DoT
    – Warok
    Commented Oct 25, 2018 at 7:44
  • How should we know? We don't know what you see (no pcap provided) and we don't know your network setup (is the source of the request even the machine where Firefox is running on, what else is running on this machine?).
    – Steffen Ullrich
    Commented Oct 25, 2018 at 7:46
  • 1
    "And if so, what is the difference between DoH and DoT"- basically the first is wrapped a DNS query (binary or JSON) inside HTTP inside TLS and the second is the binary DNS query directly inside TLS, similar to DNS over TCP. But that should be obvious from reading the RFC (which you did) so it is unclear what you still want to know.
    – Steffen Ullrich
    Commented Oct 25, 2018 at 7:50
  • 3
    The screenshot from wireshark clearly shows TLS using port 443. Which means if this is a DNS request then it is the expected DoH and not DoT since DoT uses port 853. If you have any more questions to this please edit your question with all the needed details instead of posting everything into comments only.
    – Steffen Ullrich
    Commented Oct 25, 2018 at 8:00

1 Answer 1

Reset to default
4

In order to answer the original question, i.e. "what is the difference".

In your mind TLS may be synonymous with HTTPS, but it's not. TLS stands for "transport layer security" (formerly: SSL which was secure socket layers). SSL or TLS mean that the original protocol does not change, but that the payload packets are just transported in a "secure" manner by using encryption on the TCP layer. (As opposed to encrypting the payload and transmitting the cyphertext over an unencryptet connection.)

So HTTPS in fact is "HTTP over SSL/TLS" in other words.

DNS over HTTPS would then translate into DNS over HTTP over SSL/TLS, which is what it means. The DNS protocol (which is not HTTP at all) is packed into an HTTP kind of wrapper format and then send over an SSL/TLS encrypted connection.

The pros and cons and the purpose of one or another are an entirely seperate story but I understand this isn't what you are asking.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .