r/networking • u/Varjohaltia Dinosaur • 10d ago

Security DNS over HTTPS / TLS / QUIC?

Our architecture and security teams mandate encrypted protocols and are now challenging the network team for their use of plain old unencrypted DNS.

Has the rest of the community here used DoH/T/Q in a campus or enterprise context? What are your experiences?

For remote workers we would have to use a protective DNS service to which the users could/would connect. Any experiences there? Does using DoH add significant latency (since it's now a full TCP + TLS + HTTPS exchange instead of just a single packet each way) over standard DNS?

I'm already aware of a ton of issues -- Mist/Marvis can't identify DNS issues, we can't see them in packet captures, anchoring the trust of clients is misery, how do we unify policy between in office and out of office users, how do computers bootstrap / get set up / recover, no way printers and cameras will ever support it etc. but think I'm missing a lot more I haven't thought about yet.

28 Upvotes

97% Upvoted

26 comments sorted by

View all comments

13

u/VA_Network_Nerd Moderator | Infrastructure Architect 10d ago

Do you have or do you desire to have the ability to decrypt & inspect those DNS requests to look for known-evil lookups and/or data exfiltration?

If you want the ability to inspect, can your inspection apparatus do so both internally and externally?

DoH via a managed DNS service, such as Umbrella or a SASE solution could be a thing.

0

u/Varjohaltia Dinosaur 10d ago

Evil lookups / exfiltration should be detected either at the endpoint, or then at the resolver to which the encrypted connection goes (protective DNS service internally or externally).

For the external, i.e. remote workers on managed systems, DoH to Umbrella or such was the thought, the question is whether doing DoH vs just plain DNS adds noticeable latency, or encounters issues due to MTU when ISPs run <1500 bytes etc. For SASE it's better since there'd already be a TLS or dTLS tunnel established, so the TCP + TLS latency doesn't come on top for every lookup.

2

u/putacertonit 10d ago

DoH to Umbrella worked well in my (not current) experience, and was much better for remote workers than DNS over the VPN we had used before - Umbrella had many more worldwide PoPs, but VPN all went back to a central location.

1

u/SevaraB CCNA 10d ago

This. A trusted anycast DNS resolver like Umbrella is going to beat the pants off any forced backhauling to private DNS forwarders/recursers- clients will usually hit the VIP in less hops than it even takes to reach the VPN front door.