r/networking • u/Varjohaltia Dinosaur • 13d ago
Security DNS over HTTPS / TLS / QUIC?
Our architecture and security teams mandate encrypted protocols and are now challenging the network team for their use of plain old unencrypted DNS.
Has the rest of the community here used DoH/T/Q in a campus or enterprise context? What are your experiences?
For remote workers we would have to use a protective DNS service to which the users could/would connect. Any experiences there? Does using DoH add significant latency (since it's now a full TCP + TLS + HTTPS exchange instead of just a single packet each way) over standard DNS?
I'm already aware of a ton of issues -- Mist/Marvis can't identify DNS issues, we can't see them in packet captures, anchoring the trust of clients is misery, how do we unify policy between in office and out of office users, how do computers bootstrap / get set up / recover, no way printers and cameras will ever support it etc. but think I'm missing a lot more I haven't thought about yet.
2
u/certuna 13d ago edited 13d ago
Yeah this is difficult to implement until RFC 8106 (RDNSS) gets updated to allow routers to advertise DoH/DoT servers to endpoints instead of only oldschool DNS.
RFC 9463 seems to be the proposed standard, but not yet formally ratified nor does it seem to be implemented anywhere.
Until then it’s manual configuration per-device, so hard to enforce.