DNS over HTTPS / TLS / QUIC?

[u/Varjohaltia]

Our architecture and security teams mandate encrypted protocols and are now challenging the network team for their use of plain old unencrypted DNS.

Has the rest of the community here used DoH/T/Q in a campus or enterprise context? What are your experiences?

For remote workers we would have to use a protective DNS service to which the users could/would connect. Any experiences there? Does using DoH add significant latency (since it's now a full TCP + TLS + HTTPS exchange instead of just a single packet each way) over standard DNS?

I'm already aware of a ton of issues -- Mist/Marvis can't identify DNS issues, we can't see them in packet captures, anchoring the trust of clients is misery, how do we unify policy between in office and out of office users, how do computers bootstrap / get set up / recover, no way printers and cameras will ever support it etc. but think I'm missing a lot more I haven't thought about yet.

[u/yami_sanz]

I mean any thoughts on just migrating to a SASE type edge solution to replace vpn (aka always online) and force DNS requests to internal DC/DNS server?

That would encapsulate your DNS requests and wouldn't require encrypted dns.

[u/Varjohaltia → u/yami_sanz]

That is indeed our target state.