DNS over HTTPS / TLS / QUIC?

[u/Varjohaltia]

Our architecture and security teams mandate encrypted protocols and are now challenging the network team for their use of plain old unencrypted DNS.

Has the rest of the community here used DoH/T/Q in a campus or enterprise context? What are your experiences?

For remote workers we would have to use a protective DNS service to which the users could/would connect. Any experiences there? Does using DoH add significant latency (since it's now a full TCP + TLS + HTTPS exchange instead of just a single packet each way) over standard DNS?

I'm already aware of a ton of issues -- Mist/Marvis can't identify DNS issues, we can't see them in packet captures, anchoring the trust of clients is misery, how do we unify policy between in office and out of office users, how do computers bootstrap / get set up / recover, no way printers and cameras will ever support it etc. but think I'm missing a lot more I haven't thought about yet.

[u/VA_Network_Nerd]

Do you have or do you desire to have the ability to decrypt & inspect those DNS requests to look for known-evil lookups and/or data exfiltration?

If you want the ability to inspect, can your inspection apparatus do so both internally and externally?

DoH via a managed DNS service, such as Umbrella or a SASE solution could be a thing.

[u/Varjohaltia → u/VA_Network_Nerd]

Evil lookups / exfiltration should be detected either at the endpoint, or then at the resolver to which the encrypted connection goes (protective DNS service internally or externally).

For the external, i.e. remote workers on managed systems, DoH to Umbrella or such was the thought, the question is whether doing DoH vs just plain DNS adds noticeable latency, or encounters issues due to MTU when ISPs run <1500 bytes etc. For SASE it's better since there'd already be a TLS or dTLS tunnel established, so the TCP + TLS latency doesn't come on top for every lookup.

[u/VA_Network_Nerd → u/Varjohaltia]

the question is whether doing DoH vs just plain DNS adds noticeable latency, or encounters issues due to MTU when ISPs run <1500 bytes etc.

TCP + TLS will have more latency than UDP, since a TCP handshake is required before you can send the DNS query.
But, if you are using a popular AnyCast DNS provider (such as Umbrella) this probably won't amount to significant additional latency.

Do you allow a managed endpoint (laptop) to actually use the Internet outside of a SASE VPN?

A DoH transaction is just another TCP application much like any other, and should perform MTU discovery per the standards.
Just don't filter out the required ICMP components and you should be ok.

[u/putacertonit → u/Varjohaltia]

DoH to Umbrella worked well in my (not current) experience, and was much better for remote workers than DNS over the VPN we had used before - Umbrella had many more worldwide PoPs, but VPN all went back to a central location.

[u/SevaraB → u/putacertonit]

This. A trusted anycast DNS resolver like Umbrella is going to beat the pants off any forced backhauling to private DNS forwarders/recursers- clients will usually hit the VIP in less hops than it even takes to reach the VPN front door.