3

I am reading up on secure DNS (DoH, DoT) and trying to identify its differences. Currently, I am on https://www.cloudflare.com/learning/dns/dns-over-tls/ page.

enter image description here

Is there for example some non-negligible performance hit between those two?

Is one safer, or generally better than the other? What about their relation of them to DNSSEC?

I have a relatively good home router based on OpenWrt that comes with DoT from the factory:

enter image description here

Thanks if anyone could elaborate.

Improve this question
6
  • Now Cloudflare can see all your DNS traffic. Do you trust Cloudflare?
    – user253751
    Jan 5 at 0:49
  • @user253751 Very much so! yes
    – Vlastimil Burián
    Jan 5 at 0:50
  • DoT should in theory be a lot faster because it works directly, while DoH works using an SSL HTTP connection, so there's an overhead. In daily life however I've not noticed any difference as long as upstream DNS servers are close to you.
    – Artem S. Tashkinov
    Jan 5 at 2:23
  • " What about their relation of them to DNSSEC?". None. DoH/DoT/DoQ secure the transit of data and gives no guarantee on authenticity. DNSSEC adds authentication in the sense of proving that the content received did really come from owner of the domain.
    – Patrick Mevzek
    Jan 5 at 3:10
  • 1
    @ArtemS.Tashkinov: DoH and DoT both do a TLS (no longer SSL) handshake first; the only difference is whether the data after the handshake has HTTP headers, which are very small and on today's systems take negligible time. And OP: since they both use (the same) TLS, there is no difference in security.
    – dave_thompson_085
    Jan 5 at 4:12

1 Answer 1

Reset to default
4

DNS over HTTPS and DNS over TLS offer equivalent security in terms of encryption and integrity. That's because HTTPS is essentially HTTP over TLS. There are certainly various versions of TLS and various algorithms, and some are better than others, but assuming a secure set of algorithms and parameters, they provide equivalent security. Both of them are designed to provide privacy, integrity, and authenticity to and from the recursive DNS resolver you're using for your network.

DNS over TLS does provide some advantages in that neither side needs to implement HTTP. HTTP is a complicated protocol which requires careful parsing, and an HTTP implementation may have additional security vulnerabilities or performance penalties that a plain DNS over TLS implementation would not. The main advantage of DNS over HTTPS is that it's harder to filter out than DNS over TLS because it goes over the HTTPS port and an attacker cannot determine easily what the contents are. (In this case, the attacker could well be your network administrator or local government.)

Now, none of these tell you whether the data you received is what the zone owner put in the zone. DNSSEC is a system of digitally signing DNS records such that they are unable to be modified except by the owner of the zone. Its use is controversial, but it does prevent attacks from things like captive portals substituting fraudulent DNS records.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .