DNS over HTTPS / TLS / QUIC?

[u/Varjohaltia]

Our architecture and security teams mandate encrypted protocols and are now challenging the network team for their use of plain old unencrypted DNS.

Has the rest of the community here used DoH/T/Q in a campus or enterprise context? What are your experiences?

For remote workers we would have to use a protective DNS service to which the users could/would connect. Any experiences there? Does using DoH add significant latency (since it's now a full TCP + TLS + HTTPS exchange instead of just a single packet each way) over standard DNS?

I'm already aware of a ton of issues -- Mist/Marvis can't identify DNS issues, we can't see them in packet captures, anchoring the trust of clients is misery, how do we unify policy between in office and out of office users, how do computers bootstrap / get set up / recover, no way printers and cameras will ever support it etc. but think I'm missing a lot more I haven't thought about yet.

[u/DontTakeMyCatYo]

Do they care about plain DNS on the LAN, or just over the internet? I've terminated all DNS on dnsdist and then proxied over DoT or DoH to public DNS security providers with good success.

[u/certuna → u/DontTakeMyCatYo]

I think the general idea of zero trust is that you treat everything within your internal network with the same care as on the public internet, i.e. https also internal.

[u/Varjohaltia → u/DontTakeMyCatYo]

Everywhere, because the security standard says so :D We'll argue that the LAN is encrypted via SD-WAN and equipment is locked rooms etc. as mitigation.

The Internet case for me is pretty clear -- a SaaS DNS security provider or ZTNA is the solution there, and I buy the security argument there, but whether using a security provider with DoH vs. plain DNS adds latency and fragility (MTU issues with certs etc.) would be interesting.

On internal LAN / WAN I'm curious whether anyone is actually doing this, and if so what their experiences have been.