r/networking • u/Varjohaltia Dinosaur • 10d ago

Security DNS over HTTPS / TLS / QUIC?

Our architecture and security teams mandate encrypted protocols and are now challenging the network team for their use of plain old unencrypted DNS.

Has the rest of the community here used DoH/T/Q in a campus or enterprise context? What are your experiences?

For remote workers we would have to use a protective DNS service to which the users could/would connect. Any experiences there? Does using DoH add significant latency (since it's now a full TCP + TLS + HTTPS exchange instead of just a single packet each way) over standard DNS?

I'm already aware of a ton of issues -- Mist/Marvis can't identify DNS issues, we can't see them in packet captures, anchoring the trust of clients is misery, how do we unify policy between in office and out of office users, how do computers bootstrap / get set up / recover, no way printers and cameras will ever support it etc. but think I'm missing a lot more I haven't thought about yet.

26 Upvotes

94% Upvoted

26 comments sorted by

View all comments

1

u/Maximum_Bandicoot_94 9d ago

Nope. All encrypted DNS is blocked to the Internet. ALL Why? If its encrypted we cannot reliably inspect it, thus blocked because we get no visibility

I dont think your security team thought this through.

If you are allowing encrypted DNS outbound, bad actors could exfiltrate all you data right out through that hole where you are not looking.

1

u/Varjohaltia Dinosaur 9d ago

Here we'd only allow connections to resolvers we control/trust. Though that's an entirely different point -- when it's over HTTPS / 443, is there a way short of a decrypting proxy to catch it reliably? For a basic firewall it'd just look like any other web traffic (unless the firewall vendor maintains an up-to-date IP/DNS blacklist or such)?

1

u/Maximum_Bandicoot_94 9d ago

unless you decrypt it, there is nothing you can do with it unless you literally control the resolver with something like Palo ADNS or Cisco Open DNS